CVE-2025-31276 - Vulnerability Details - OpenCVE

This issue was addressed through improved state management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Remote content may be loaded even when the 'Load Remote Images' setting is turned off.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Apple	Ios Ipados

No data.

No data.

References

Link	Providers
https://support.apple.com/en-us/124147
https://support.apple.com/en-us/124148

History

Wed, 30 Jul 2025 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-359
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 30 Jul 2025 11:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apple Apple ios Apple ipados
Vendors & Products		Apple Apple ios Apple ipados

Wed, 30 Jul 2025 00:15:00 +0000

Type	Values Removed	Values Added
Description	This issue was addressed through improved state management. This issue is fixed in iPadOS 17.7.9, iOS 18.6 and iPadOS 18.6. Remote content may be loaded even when the 'Load Remote Images' setting is turned off.	This issue was addressed through improved state management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Remote content may be loaded even when the 'Load Remote Images' setting is turned off.

Tue, 29 Jul 2025 23:45:00 +0000

Type	Values Removed	Values Added
Description		This issue was addressed through improved state management. This issue is fixed in iPadOS 17.7.9, iOS 18.6 and iPadOS 18.6. Remote content may be loaded even when the 'Load Remote Images' setting is turned off.
References		https://support.apple.com/en-us/124147 https://support.apple.com/en-us/124148

MITRE

Status: PUBLISHED

Assigner: apple

Published: 2025-07-29T23:35:57.153Z

Updated: 2025-07-30T15:01:46.687Z

Reserved: 2025-03-27T16:13:58.344Z

Link: CVE-2025-31276

Vulnrichment

Updated: 2025-07-30T15:01:35.261Z

NVD

Status : Received

Published: 2025-07-30T00:15:30.720

Modified: 2025-07-30T15:15:32.690

Link: CVE-2025-31276

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-31276", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "state": "PUBLISHED", "assignerShortName": "apple", "dateReserved": "2025-03-27T16:13:58.344Z", "datePublished": "2025-07-29T23:35:57.153Z", "dateUpdated": "2025-07-30T15:01:46.687Z"}, "containers": {"cna": {"problemTypes": [{"descriptions": [{"lang": "en", "description": "Remote content may be loaded even when the 'Load Remote Images' setting is turned off"}]}], "affected": [{"vendor": "Apple", "product": "iPadOS", "versions": [{"version": "unspecified", "status": "affected", "lessThan": "17.7", "versionType": "custom"}]}, {"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"version": "unspecified", "status": "affected", "lessThan": "18.6", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "This issue was addressed through improved state management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Remote content may be loaded even when the 'Load Remote Images' setting is turned off."}], "references": [{"url": "https://support.apple.com/en-us/124148"}, {"url": "https://support.apple.com/en-us/124147"}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2025-07-29T23:54:49.379Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-359", "lang": "en", "description": "CWE-359 Exposure of Private Personal Information to an Unauthorized Actor"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-07-30T15:01:40.281222Z", "id": "CVE-2025-31276", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-30T15:01:46.687Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-31276", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-30T15:01:40.281222Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-359", "description": "CWE-359 Exposure of Private Personal Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-30T15:01:35.261Z"}}], "cna": {"affected": [{"vendor": "Apple", "product": "iPadOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "17.7", "versionType": "custom"}]}, {"vendor": "Apple", "product": "iOS and iPadOS", "versions": [{"status": "affected", "version": "unspecified", "lessThan": "18.6", "versionType": "custom"}]}], "references": [{"url": "https://support.apple.com/en-us/124148"}, {"url": "https://support.apple.com/en-us/124147"}], "descriptions": [{"lang": "en", "value": "This issue was addressed through improved state management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Remote content may be loaded even when the 'Load Remote Images' setting is turned off."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Remote content may be loaded even when the 'Load Remote Images' setting is turned off"}]}], "providerMetadata": {"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "shortName": "apple", "dateUpdated": "2025-07-29T23:54:49.379Z"}}}, "cveMetadata": {"cveId": "CVE-2025-31276", "state": "PUBLISHED", "dateUpdated": "2025-07-30T15:01:46.687Z", "dateReserved": "2025-03-27T16:13:58.344Z", "assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c", "datePublished": "2025-07-29T23:35:57.153Z", "assignerShortName": "apple"}, "dataVersion": "5.1"}