CYPHERLOCK, INC.

AirPlay Zero-Click RCE Vulnerability Permits Remote Wi-Fi Device Compromise

AirPlay Zero-Click RCE Vulnerability Permits Remote Wi-Fi Device Compromise

A critical flaw in Apple’s AirPlay protocol, dubbed AirBorne, has put more than 2.35 billion active Apple devices—and tens of millions of third-party devices—at risk of zero-click remote code execution (RCE) attacks.

Discovered by researchers at Oligo Security, the vulnerability allows attackers connected to the same Wi-Fi network to take control of a wide range of devices, including Macs, iPhones, CarPlay-enabled vehicles, and smart speakers, all without any user interaction.

The AirBorne Vulnerabilities

The AirBorne threat arises from multiple weaknesses in Apple’s AirPlay protocol and its associated Software Development Kit (SDK), which is used by third-party manufacturers to support AirPlay. Oligo Security uncovered 23 vulnerabilities, with 17 earning CVE identifiers. Key among them:

  • CVE-2025-24252: A use-after-free vulnerability in macOS’s AirPlay implementation.
  • CVE-2025-24206: An authentication bypass flaw.

When chained together, these issues allow attackers to achieve full zero-click RCE on devices configured to accept connections from “Anyone on the same network.”

CVE-2025-24132: A stack-based buffer overflow in the AirPlay SDK impacts speakers, smart TVs, and CarPlay systems, enabling wormable zero-click exploits across affected devices.

CVE-2025-24271: An access control list (ACL) bypass vulnerability allows attackers to send unauthenticated AirPlay commands. When combined with other flaws, it can lead to one-click remote code execution (RCE).

These vulnerabilities primarily exploit how AirPlay handles property lists (plists)—structured data formats used to serialize commands. Improper validation of these inputs, such as assuming all plists are dictionaries, has resulted in type confusion, memory corruption, and ultimately arbitrary code execution.

For example:

  • Sending malformed plists via the /setProperty command can crash the ControlCenter process.
  • Flooding RTSP SETUP requests can overload the WindowServer service, forcibly logging users out of their sessions.

Attack Vectors and Real-World Impact

The AirBorne vulnerabilities present a wide range of attack scenarios:

  • Apple Devices: Macs and iOS devices with AirPlay Receiver enabled (default: “Current User”) are susceptible to zero-click attacks when combined with CVE-2025-24206. Oligo researchers demonstrated an exploit chain that overwrites memory in the Apple Music app, potentially enabling malware propagation across the network.
  • Third-Party Devices: Speakers and CarPlay units using the vulnerable SDK are equally exposed. In one test, researchers hijacked a Bose speaker to display rogue logos and play unauthorized audio.
  • Wormable Buffer Overflow (CVE-2025-24132): This flaw enables self-propagating attacks. A single compromised device in a corporate environment could infect others without user interaction, facilitating lateral movement for espionage or ransomware. Public Wi-Fi environments, such as airports, are especially high-risk.
  • CarPlay Exploits: Over 800 car models with wireless CarPlay support are vulnerable to proximity-based attacks. If a car’s Wi-Fi hotspot has a weak password, an attacker within range could execute RCE to manipulate infotainment features—playing unwanted audio, tracking location, or eavesdropping through built-in microphones. Even Bluetooth-based pairing (with PIN entry) and USB connections are not immune.

Apple’s Response and Patch Status

Apple has addressed these issues in:

  • macOS Sequoia 15.4
  • iOS 18.4
  • AirPlay SDK versions 2.7.1 and 3.6.0.126

However, Oligo warns that many third-party devices may remain unpatched due to fragmented or slow firmware update mechanisms.

“AirPlay’s integration into diverse ecosystems means some devices will linger vulnerable for years,”
— Gal Elbaz, Co-Founder, Oligo Security

Mitigation Recommendations

To reduce risk, Oligo and Apple recommend the following steps:

  • Update Apple Devices: Ensure all Apple products are running the latest OS versions.
  • Disable AirPlay Receiver: Turn off AirPlay in settings if it’s not in use.
  • Harden Network Access: Restrict access to port 7000 (used by AirPlay) through firewalls and network segmentation.
  • Check Third-Party Devices: Reach out to manufacturers for SDK updates and monitor firmware releases closely.

Conclusion

The AirBorne vulnerabilities highlight systemic risks in widely used protocols like AirPlay. With Apple’s ecosystem now comprising over 2.35 billion active devices and countless third-party integrations, timely patching and coordinated disclosure are critical.

Still, the reality of long-lived, unpatched devices in both consumer and industrial environments poses an ongoing security challenge. Proactive IoT security practices, from firmware lifecycle management to protocol-level validation, are more necessary than ever.

Apple has not observed active exploitation in the wild but has acknowledged the critical nature of these vulnerabilities and urges all users and organizations to apply updates immediately. For enterprises, Oligo recommends:

  • Segmenting networks to isolate AirPlay-enabled endpoints.
  • Auditing connected devices for signs of compromise.

More Articles & Posts

Scopes

2025 Active Exploitation AI Alert Analysis Attack Attackers Attacks Breach Breaches Campaigns China chrome CISA Cisco CISO CISOs credentials Critical Critical Flaw Critical Vulnerability CrowdStrike Cutting-Edge Cyber Attack Cyberattack cyberattacks Cybercriminals cybersecurity Cybersecurity Initiatives Cybersecurity Solutions Cyber Threats DDoS Attacks Discovered Enables Exploit Exploited Exploiting Exploits Exposes FBI Flaw Generative AI google Guide Hackers Hackers Exploit Healthcare Hijack Hit Insights Invest Ivanti Linux macOS malicious malware Massive data Breach MFA microsoft Microsoft 365 Microsoft Azure NIST Patch Phishing Phishing Attack PoC Privilege Escalation Ransomware Ransomware Attack ransomware attacks RCE RCE Vulnerability Released Remote Code Execution Researchers risk Scam security Security Flaw Strategies Strategy Systems Target Targeted Targeting Targets Threat Actors Threat Intelligence threats UK Unauthorized Code Execution Under Attack Users vulnerabilities Vulnerability WhatsApp windows Windows 11 Windows Systems Zero-Day