Memory Handling Vulnerabilities in Apple AirPlay and CarPlay Products
CVE-2025-24132

6.5MEDIUM

Key Information:

Vendor

Apple
Status
Airplay Audio Sdk
Airplay Video Sdk
Carplay Communication Plug-in
Vendor
CVE Published:
30 April 2025

Badges

šŸ“ˆ Score: 258šŸ‘¾ Exploit ExistsšŸ“° News Worthy

What is CVE-2025-24132?

CVE-2025-24132 is a memory handling vulnerability discovered in Appleā€™s AirPlay and CarPlay products. These technologies enable wireless streaming of audio and video content from devices to supported displays and audio systems, commonly used in various consumer electronics. The vulnerability arises from improper memory management, allowing an attacker on the local network to potentially cause an unexpected termination of applications utilizing these protocols. This could disrupt service and affect the reliability of streaming and communication applications reliant on AirPlay and CarPlay, posing risks to user experience and potentially leading to service downtime in environments that utilize these technologies for critical operations.

Potential impact of CVE-2025-24132

  1. Service Disruption: The vulnerability could lead to unexpected application terminations, interrupting ongoing services and affecting user accessibility to streaming content and connected device functionalities.

  2. Network Exploitation: Local network attackers may exploit this vulnerability to create instability in connected systems, potentially leading to broader issues of trust and reliability in network services dependent on AirPlay and CarPlay.

  3. Reputational Damage: Organizations that rely on Appleā€™s streaming solutions may suffer reputational harm if users experience frequent disruptions, leading to dissatisfaction and concerns about the reliability and security of the organizationā€™s technological infrastructure.

Affected Version(s)

AirPlay audio SDK < 2.7.1

AirPlay video SDK < 3.6.0.126

CarPlay Communication Plug-in < unspecified

News Articles

Apple CarPlay RCE Exploit Left Unaddressed in Most Cars

Even when a vulnerability is serious and a fix is available, actually securing cars is more difficult than one would hope.

favicon imageHackread

Billions of Apple Devices at Risk from ā€œAirBorneā€ AirPlay Vulnerabilities - Update Now!

AirBorne flaws in Apple AirPlay expose billions of devices to remote attacks, RCE, data theft. Update iPhones, Macs, CarPlay and 3rd-party devices.

References

https://support.apple.com/en-us/122403

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • šŸ‘¾

    Exploit known to exist

  • šŸ“°

    First article discovered by Hackread

  • Vulnerability published

JSON
.
CVE-2025-24132 : Memory Handling Vulnerabilities in Apple AirPlay and CarPlay Products