CVE-2025-31227
📋 TL;DR
This vulnerability allows attackers with physical access to an iOS/iPadOS device to recover deleted call recordings. The issue stems from improper access controls in call recording deletion logic. Only users with outdated iOS/iPadOS versions are affected.
💻 Affected Systems
- iPhone
- iPad
📦 What is this software?
Ipados by Apple
⚠️ Risk & Real-World Impact
Worst Case
Sensitive call recordings thought to be permanently deleted could be recovered by someone with brief physical access to the device, potentially exposing confidential conversations.
Likely Case
An attacker with temporary physical access could recover recently deleted call recordings containing personal or business information.
If Mitigated
With proper device security controls (passcodes, biometrics) and physical security, the risk is significantly reduced as attackers would need to bypass device locks first.
🎯 Exploit Status
Exploitation requires physical device access and likely bypassing device locks first.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: iOS 18.5, iPadOS 18.5
Vendor Advisory: https://support.apple.com/en-us/122404
Restart Required: Yes
Instructions:
1. Open Settings app. 2. Tap General. 3. Tap Software Update. 4. Download and install iOS/iPadOS 18.5 update. 5. Restart device when prompted.
🔧 Temporary Workarounds
Disable call recording
allTurn off call recording functionality to eliminate the attack surface.
Enable strong device authentication
allUse strong passcodes and biometric authentication to prevent unauthorized physical access.
🧯 If You Can't Patch
- Implement strict physical security controls for devices containing sensitive call recordings.
- Use encrypted call recording solutions that properly handle deletion at the encryption level.
🔍 How to Verify
Check if Vulnerable:
Check iOS/iPadOS version in Settings > General > About. If version is earlier than 18.5, device is vulnerable.Check Version:
Settings > General > About > VersionVerify Fix Applied:
After updating, verify version shows 18.5 or later in Settings > General > About.📡 Detection & Monitoring
Log Indicators:
- Unusual physical access patterns to devices
- Multiple failed authentication attempts followed by successful access
Network Indicators:
- None - this is a local physical access vulnerability
SIEM Query:
Device authentication logs showing suspicious access patterns to iOS/iPadOS devices