PT-2025-37781 · Apple · Safari+3

Evan Waelde · Published 2025-09-15 · Updated 2025-09-16 · CVE-2025-31254

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Safari versions prior to 26 iOS versions prior to 26 iPadOS versions prior to 26

Description Processing maliciously crafted web content may lead to unexpected URL redirection due to improved URL validation.

Recommendations Update Safari to version 26. Update iOS to version 26. Update iPadOS to version 26.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-11288

CVE-2025-31254

Affected Products

Apple Macos

Safari

Ios

Ipados

References · 10

• https://support.apple.com/en-us/125113 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11288 · Security Note
• https://osv.dev/vulnerability/CVE-2025-31254 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-31254 · Security Note
• https://support.apple.com/en-us/125108 · Vendor Advisory
• https://support.apple.com/ru-ru/125113 · Note
• https://support.apple.com/ru-ru/125108 · Note
• http://seclists.org/fulldisclosure/2025/Sep/59 · Note
• https://twitter.com/CVEnew/status/1967819555037757872 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31254 · Note