CVE-2025-31229: Apple iPadOS Information Disclosure Flaw

CVE-2025-31229 Overview

CVE-2025-31229 is a logic flaw in Apple iOS and iPadOS that causes the device passcode to be read aloud by VoiceOver, the built-in screen reader. The issue allows the passcode to be exposed audibly to anyone within hearing range of the device. Apple addressed the flaw in iOS 18.6 and iPadOS 18.6 by adding improved checks. The weakness maps to CWE-261: Weak Encoding for Password. The vulnerability does not require user authentication or interaction to trigger and carries a network attack vector classification, with high impact to confidentiality and availability.

Critical Impact
An adversary within audible range of the device can capture the user's passcode through VoiceOver output, bypassing on-screen masking protections.

Affected Products

Apple iOS prior to 18.6
Apple iPadOS prior to 18.6
Devices with VoiceOver accessibility features enabled

Discovery Timeline

2025-07-30 - CVE-2025-31229 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-31229

Vulnerability Analysis

The flaw resides in the interaction between the iOS passcode entry interface and the VoiceOver accessibility service. VoiceOver narrates on-screen content to assist users with visual impairments. Under normal conditions, the passcode entry screen must suppress narration of secret characters. A logic error in the affected versions causes VoiceOver to announce passcode digits or characters rather than treating them as masked secrets.

The weakness corresponds to [CWE-261], which covers improper handling of sensitive credential material. The exposure converts a credential intended for visual masking into an audible signal. Anyone in the surrounding environment, or any nearby recording device, can capture the value. The result is an authentication factor disclosed through an unintended output channel.

Apple categorized the issue as a logic flaw and resolved it through additional checks in the VoiceOver narration pipeline. The patch enforces that passcode field content is treated as confidential and is not vocalized.

Root Cause

The accessibility subsystem failed to apply secure-text-field semantics when narrating the passcode entry view. The text input field metadata did not propagate the secure-entry attribute to the VoiceOver speech engine. As a result, the speech engine processed the field contents as ordinary text.

Attack Vector

Exploitation requires the victim to enter the passcode while VoiceOver is active. An attacker positioned within hearing distance, or with access to a nearby microphone, captures the spoken passcode. No code execution or remote network access is required to harvest the credential once it is read aloud.

Apple has not released technical exploitation details. See the Apple Security Advisory and the Full Disclosure Mailing List post for vendor and public discussion.

Detection Methods for CVE-2025-31229

Indicators of Compromise

Devices reporting iOS or iPadOS build versions earlier than 18.6 with VoiceOver enabled in accessibility settings
User reports of passcode digits or characters being audibly announced during lock-screen unlock
Mobile device management (MDM) inventory entries showing unpatched iOS or iPadOS versions on devices used in shared or public environments

Detection Strategies

Query MDM platforms for iOS and iPadOS version distribution and flag any device below build 18.6
Audit accessibility configuration profiles to identify devices with VoiceOver enabled and an outdated operating system
Correlate help-desk tickets referencing accessibility behavior anomalies on Apple mobile devices

Monitoring Recommendations

Enforce continuous compliance reporting through MDM for minimum OS version 18.6 across managed iPhones and iPads
Track patch adoption metrics weekly until full fleet compliance is achieved
Monitor Apple security advisories for follow-up issues affecting the VoiceOver subsystem

How to Mitigate CVE-2025-31229

Immediate Actions Required

Update all iPhones to iOS 18.6 or later and all iPads to iPadOS 18.6 or later
Instruct users who rely on VoiceOver to enter the passcode in private until devices are patched
Force MDM-driven OS updates for enrolled devices that have not received the patch

Patch Information

Apple released fixes in iOS 18.6 and iPadOS 18.6. The vendor advisory is available at the Apple Security Advisory. Apply the update through Settings > General > Software Update or push the update through MDM.

Workarounds

Disable VoiceOver on the lock screen for devices that cannot be immediately updated
Use Face ID or Touch ID for unlock to avoid passcode entry while the screen reader is active
Connect wired or Bluetooth headphones during passcode entry so narration is not broadcast aloud

bash

# MDM compliance check example (pseudo-policy)
require:
  platform: iOS
  minimum_os_version: "18.6"
action_on_noncompliance:
  - notify_user
  - enforce_update
  - restrict_corporate_access