CVE-2025-31200 is a zero-day, zero-click RCE in iOS CoreAudio’s AudioConverterService, triggered by a malicious audio file via iMessage/SMS. Exploitation bypassed Blastdoor, enabled kernel escalation (CVE-2025-31201), and allowed token theft until patched in iOS 18.4.1 (Apr 16, 2025).# CVE-2025-31200 & CVE-2025-31201 | iMessage Zero-Click RCE Chain
Public disclosure of two linked vulnerabilities in Apple's iOS 18.x:
- **CVE-2025-31200** — Heap corruption in CoreAudio’s `AudioConverterService`, triggered by a malicious audio file delivered via iMessage. Zero-click, no user interaction required.
- **CVE-2025-31201** — Pointer Authentication (PAC) bypass in the RPAC path, enabling reliable kernel exploitation once arbitrary R/W is achieved.
---
## Disclosure & Patch Timeline
- **Initial Report Date:** January 21, 2025
- **Reported To:** Apple & US-CERT (Tracking ID: VRF#25-01-MPVDT)
- **Patched By Apple:** Silently resolved in **iOS 18.4.1**, released **April 16, 2025**
- **CVE Assignment:** Identifiers **CVE-2025-31200** and **CVE-2025-31201** were assigned publicly due to lack of MITRE response
Due to the severity, prolonged silence from relevant stakeholders, and absence of acknowledgment post-patch, this repository is published to inform the security community and support defensive mitigation.
---
## Affected Systems
- **iOS Versions:** Zero-day until patched in **iOS 18.4.1 (April 16, 2025)**
- **Primary Vulnerable Component:** `AudioConverterService` (CoreAudio) via iMessage / SMS delivery
- **Chained Component:** RPAC / Pointer Authentication (PAC bypass, CVE-2025-31201)
- **Post-Exploitation Impact:** Wireless subsystem manipulation and CryptoTokenKit abuse (no CVE assigned)
---
## 🛡️ Disclaimer
This report is released in the interest of public safety, transparency, and to support defenders and researchers. All information is based on independent research. No offensive code is included. The author remains open to coordination with trusted parties for validation and response.
登录后查看神龙缓存的 POC 文件快照
登录查看