Two denial of service vulnerabilities in Apple AirPlay SDK and CarPlay Communication Plug-in

Published: 2025-04-29 | Updated: 2025-05-16

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2025-24132 CVE-2025-30422
CWE-ID	CWE-119
Exploitation vector	Local network
Public exploit	Public exploit code for vulnerability #1 is available.
Vulnerable software	AirPlay audio SDK Universal components / Libraries / Software for developers AirPlay video SDK Universal components / Libraries / Software for developers CarPlay Communication Plug-in Universal components / Libraries / Software for developers
Vendor	Apple Inc.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Buffer overflow

EUVDB-ID: #VU108039

Risk: Low

CVSSv4.0: 2.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/U:Clear]

CVE-ID: CVE-2025-24132

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in SDK. A remote attacker on the local network can trigger memory corruption and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

AirPlay audio SDK: before 2.7.1

AirPlay video SDK: before 3.6.0.126

CarPlay Communication Plug-in: before R18.1

CPE2.3

External links

https://support.apple.com/en-us/122403

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Buffer overflow

EUVDB-ID: #VU108040