KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2025-31277
8.8
3-Day Required
PoC Available
KEV
Active Exploitation
Details
VulnerabilityApple Multiple Products Buffer Overflow Vulnerability
VendorApple
ProductMultiple Products
Date added2026-03-20
Due date2026-04-03
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-119
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Descriptions
KEV: Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption.
NVD: The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.
Compliance SSVC + BOD 26-04
Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required
Research metadata
Last researched2026-08-28 10:53 UTC
Wall time75.0s
Searches4
Component defaultyes
Sources
https://github.com/stationedK-06/DarkSword_analysis
https://cve.circl.lu/known-exploited-vulnerabilities-catalog/274f0726-4043-49ae-b09c-dd4c5e739b43
https://support.apple.com/en-us/124147
https://www.iverify.com/blog/darksword-ios-exploit-kit-explained
https://exploit-intel.com/vuln/CVE-2025-31277
https://www.sentinelone.com/vulnerability-database/cve-2025-31277/
https://support.apple.com/en-us/124152
https://www.lookout.com/threat-intelligence/article/webkit-vulnerability-and-darksword-exploit
https://nvd.nist.gov/vuln/detail/CVE-2025-31277
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?f=vendor_project%3A906&field_cve=CVE-2025-31277
https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain
https://cvedaily.breached.company/cve/cve-2025-31277-apple-darksword-webkit-buffer-overflow-2026-03-24
https://www.cisa.gov/news-events/alerts/2026/03/20/cisa-adds-five-known-exploited-vulnerabilities-catalog
https://cve.circl.lu/known-exploited-vulnerabilities-catalog/274f0726-4043-49ae-b09c-dd4c5e739b43
https://support.apple.com/en-us/124147
https://www.iverify.com/blog/darksword-ios-exploit-kit-explained
https://exploit-intel.com/vuln/CVE-2025-31277
https://www.sentinelone.com/vulnerability-database/cve-2025-31277/
https://support.apple.com/en-us/124152
https://www.lookout.com/threat-intelligence/article/webkit-vulnerability-and-darksword-exploit
https://nvd.nist.gov/vuln/detail/CVE-2025-31277
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?f=vendor_project%3A906&field_cve=CVE-2025-31277
https://cloud.google.com/blog/topics/threat-intelligence/darksword-ios-exploit-chain
https://cvedaily.breached.company/cve/cve-2025-31277-apple-darksword-webkit-buffer-overflow-2026-03-24
https://www.cisa.gov/news-events/alerts/2026/03/20/cisa-adds-five-known-exploited-vulnerabilities-catalog
Hunting hypothesis agent
Hunt iOS telemetry for mediaplaybackd spawning JavaScriptCore DarkSword-WIFI-DUMP, GPUProcessProxy::childConnectionDidBecomeUnresponsive, EXC_GUARD on WebContent JIT RegExp on iOS 18.4-18.6 — no stock logging, MDM/iVerify needed.
Research details
ComponentJavaScriptCore JIT engine — RegExp match code path in WebContent process, leading to type confusion and arbitrary memory read/write primitive
PreconditionsUser must visit a watering hole page (1-click) on a device running iOS 18.4 through 18.5 (or iOS 18.6-18.6.2 via the companion CVE-2025-43529 JIT use-after-free); no authentication required; the DarkSword exploit kit delivers via compromised legitimate Ukrainian websites embedding an iframe to static[.]cdncounter[.]net; chained with CVE-2026-20700 (TPRO/PAC bypass), CVE-2025-14174 (ANGLE GPU sandbox escape), and CVE-2025-43510/43520 (kernel privesc via AppleM2ScalerCSCDriver) for full device compromise agent
DeliveryWatering hole attack: compromised legitimate Ukrainian websites (novosti[.]dn[.]ua, 7aac[.]gov[.]ua) embed an iframe loading static[.]cdncounter[.]net/widget.js, which chains through /rce_loader.js to version-specific /rce_module_18.6.js or /rce_module.js containing JavaScript JIT RegExp exploit with shared cache offsets per iPhone model. 1-click trigger on vulnerable iOS version (18.4-18.6.2) launches full chain: JIT r/w primitive -> TPRO/PAC bypass via dyld stack structures -> GPU process sandbox escape via ANGLE OOB write -> kernel exploit via AppleM2ScalerCSCDriver CopyOnWrite -> mediaplaybackd JavaScriptCore injection -> in-memory implants exfiltrate data to sqwas[.]shapelie[.]com.
Public PoCyes
PoC URLs
https://github.com/stationedK-06/DarkSword_analysis
https://exploit-intel.com/vuln/CVE-2025-31277 Third-party repos; verify before use.
https://exploit-intel.com/vuln/CVE-2025-31277 Third-party repos; verify before use.
Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 8.8) | CISA KEV confirmed active exploitation | Primary 1-click RCE vector in the DarkSword exploit kit (iVerify/Google/Lookout, March 2026). The exploit is a JIT RegExp match vulnerability in JavaScriptCore leading to type confusion and arbitrary memory r/w. It targets iOS 18.4-18.5; the companion JIT UAF CVE-2025-43529 covers iOS 18.6-18.6.2. Delivered via watering holes on compromised Ukrainian news/government sites (novosti[.]dn[.]ua, 7aac[.]gov[.]ua) loading /rce_module.js from static[.]cdncounter[.]net with shared cache offsets per iPhone model and iOS version. Chained with TPRO/PAC bypass, ANGLE GPU sandbox escape, kernel CopyOnWrite exploit, and in-memory JavaScript implants (DarkSword-WIFI-DUMP) that exfiltrate keychain, WiFi passwords, SMS, and crypto wallets. Attributed to a Russian-nexus threat actor targeting Ukrainian, Saudi, Turkish, and Malaysian entities.
SummaryCVE-2025-31277 is a JavaScriptCore JIT RegExp match vulnerability in Apple's WebKit engine that enables a 1-click remote code execution chain via watering hole delivery. Exploited in the wild as the initial access vector in the DarkSword exploit kit targeting iOS 18.4-18.5 devices (with CVE-2025-43529 covering iOS 18.6-18.6.2), the chain escalates from WebContent JIT type confusion through TPRO/PAC bypass, ANGLE GPU sandbox escape, kernel CopyOnWrite exploitation, and deploys in-memory JavaScript implants (tagged DarkSword-WIFI-DUMP) that exfiltrate keychain data, WiFi passwords, communications, and cryptocurrency wallets. Attributed to a Russian-nexus threat actor; discovered by iVerify, Lookout, and Google GTIG in March 2026.
Tia coverage
First reported2026-09-01
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
packagist-themes-exploit-iphone-visitors-to-steal-messages-passw
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.