RPAC Pointer Authentication bypass

CVE-2025-31201 technical analysis

CVE-2025-31201 is a high-severity iOS vulnerability tracked as Sandbox. The published record describes rpac pointer authentication bypass affecting iOS/iPadOS < 18.4.1. In practical terms, the vulnerability should be evaluated as a specific weakness in a specific component—not as automatic evidence that every affected device can be fully compromised. The execution context, reachable interface, platform mitigations, and availability of a reliable exploit chain all shape real-world risk.

A sandbox escape or boundary-bypass vulnerability allows code to reach data or capabilities outside its intended container. Its severity depends on the destination boundary: another application, a browser process, a privileged framework, or a system service. For CVE-2025-31201, the confirmed impact recorded is: Bypassing Pointer Authentication can remove an important exploit mitigation when chained with another vulnerability.

This record lists 2025-04-16 as the public disclosure or patch date, identifies Not publicly disclosed as the discovery information currently available, and credits Apple. The remediation recorded for affected users is iOS 18.4.1 and iPadOS 18.4.1. Use the references at the end of this page as the authoritative source, because vendors can revise advisories after publication.

Attack surface and exploitation prerequisites

Most sandbox escapes assume an existing foothold inside a restricted process. Document that initial context separately from the escape itself, and determine whether the second stage needs a malicious application, browser renderer compromise, physical access, or another exploit.

A defensible assessment separates reachability, exploitation, and post-exploitation, so a component-level flaw is not described as an end-to-end device takeover. Compensating controls—network segmentation, application allow-listing, restricted messaging or browsing features, and MDM-enforced patching—can reduce exposure, but the durable resolution remains the vendor update identified in this record.

Detection and forensic triage

Inspect sandbox-denial logs, cross-process communication, entitlement failures, protected-directory access, and crashes in broker or framework processes. Review the installation and execution history of applications that could supply the initial foothold.

Absence of a visible symptom does not prove absence of exploitation, and a crash alone does not prove compromise. Preserve device state, record the operating-system build and patch level, and acquire logs using a method appropriate to the legal context—resetting or repeatedly testing the device can destroy useful traces. When assessing a suspected targeted attack, correlate device evidence with account sign-ins, messaging metadata, network telemetry, and MDM events to separate attempted delivery from successful exploitation.

How to mitigate CVE-2025-31201

The primary mitigation is straightforward: Update to iOS 18.4.1, iPadOS 18.4.1, or a later supported release.

On Apple devices, confirm the exact iOS or iPadOS build in Settings > General > About and compare it with Apple's security release documentation. Hardware generation and the supported update branch can change which fixed release is available. Lockdown Mode can reduce selected attack surfaces for users facing sophisticated targeted threats, but it is not a substitute for installing security updates.

1. Identify the exact device model, operating-system build, and current security patch level.
2. Compare that information with the affected range and fixed release documented by the vendor.
3. Back up necessary evidence before making changes when compromise is suspected.
4. Install the latest supported security release rather than stopping at the first version that mentions the CVE.
5. Verify the installed build after reboot and review related accounts and applications for follow-on activity.

PoC interpretation and research notes

This page distinguishes public disclosure from independent reproduction. Its current status is Exploited in the wild. Apple states that this issue may have been exploited in a highly targeted attack. Any PoC shown above should be reviewed in an isolated lab and used only on systems the researcher owns or is explicitly authorized to test. Public availability is not a guarantee that code is safe, complete, or accurately attributed.

Frequently asked questions about CVE-2025-31201

What is CVE-2025-31201?

CVE-2025-31201 is a iOS Sandbox vulnerability associated with rpac pointer authentication bypass. It affects iOS/iPadOS < 18.4.1, according to the currently cited disclosures. The practical risk depends on the vulnerable component, required access, available mitigations, and whether the device has received iOS 18.4.1 and iPadOS 18.4.1.

Is CVE-2025-31201 being exploited in the wild?

The status on this page is “Exploited in the wild.” A vendor-confirmed vulnerability is not necessarily known to be actively exploited. This database uses “Exploited in the wild” only when a cited vendor or authoritative security source reports observed exploitation; public PoC availability is tracked separately.

How do I protect a device from CVE-2025-31201?

Install the latest supported security update and verify the resulting build or patch level. The recorded minimum resolution is iOS 18.4.1 and iPadOS 18.4.1. Apply relevant compensating controls while updates are pending, but do not treat configuration changes as equivalent to patching the underlying vulnerability.