CVE-2025-24132

Published Apr 30, 2025

Last updated a month ago

Apple

AirPlay SDK

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-24132 is a stack-based buffer overflow vulnerability that exists in Apple's AirPlay SDK. Successful exploitation could allow a local attacker to perform zero-click remote code execution on vulnerable AirPlay SDK devices. It can also potentially lead to sensitive information disclosure through eavesdropping on devices with microphones. The vulnerability can be triggered by sending malformed pairing packets over TCP port 7000. It affects AirPlay audio SDK, AirPlay video SDK, and CarPlay Communication Plug-in. Updates have been released to address this issue in AirPlay audio SDK 2.7.1, AirPlay video SDK 3.6.0.126, and CarPlay Communication Plug-in R18.1.

Description: The issue was addressed with improved memory handling. This issue is fixed in AirPlay audio SDK 2.7.1, AirPlay video SDK 3.6.0.126, CarPlay Communication Plug-in R18.1. An attacker on the local network may cause an unexpected app termination.
Source: product-security@apple.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-119
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-119

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:apple:airplay_audio_software_development_kit:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0BEE19EA-7BD5-441D-8C25-F2529C5AF5A5",
            "versionEndExcluding": "2.7.1"
          },
          {
            "criteria": "cpe:2.3:a:apple:airplay_video_software_development_kit:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EFAC8539-73DB-4545-A221-21F5E24B9AF8",
            "versionEndExcluding": "3.6.0.126"
          },
          {
            "criteria": "cpe:2.3:a:apple:carplay_communication_plug-in:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "00E0D29A-8A73-4E08-9937-6574886D872D",
            "versionEndExcluding": "r18.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.