Loading vulnerability…
CVE-2025-24132 is a stack-based buffer overflow in Apple AirPlay-related SDK components, disclosed as part of the broader AirBorne vulnerability set. The issue affects AirPlay audio SDK versions prior to 2.7.1, AirPlay video SDK versions prior to 3.6.0.126, and CarPlay Communication Plug-in versions prior to R18.1. Public reporting states the flaw is reachable by an attacker on the same local network and impacts third-party speakers, receivers, and some CarPlay-integrated devices that implement the AirPlay SDK. Oligo reported that this vulnerability can be exploited as a zero-click remote code execution issue on vulnerable AirPlay SDK devices and that it may also cause unexpected application termination. Apple’s advisory for this CVE states the issue was addressed with improved memory handling.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
Repository contains a single Python proof-of-concept exploit (LiberationPlay.py) plus documentation (README.md) targeting CVE-2025-24132 ("AirBourne") in AirPlay/CarPlay RTSP server implementations. Core behavior/capabilities: - Establishes a TCP connection to an AirPlay RTSP service (notes that port 7000 is common; 5000 also seen). - Performs an RTSP POST to /auth-setup to negotiate a shared secret using X25519 (Curve25519) key exchange. - Parses the server’s M2 response to extract the server public key, certificate blob, and signature. - Derives AES key/IV from the shared secret using SHA1("AES-KEY"||secret) and SHA1("AES-IV"||secret), then initializes AES-CTR. - Advances the AES-CTR keystream by consuming the server signature bytes (to match server-side counter state). - Encrypts an attacker-controlled payload (default placeholder: 128 bytes of 0xFF) to produce an "ekey" value. - Sends an RTSP SETUP request with a binary plist body containing fields {name, et, ekey, eiv}. The intent is to trigger a buffer overflow/size-check bug in AES-CTR handling where the key size is assumed to be 16 bytes. Expected outcome: - Primarily a crash/DoS of the AirPlay process (script infers success when the socket closes without a response). README states it currently only triggers the overflow and causes a crash; no memory leak or RCE chain is implemented. Repository structure/purpose: - LiberationPlay.py: standalone network exploit/PoC implementing the minimal AirPlay RTSP handshake and the malformed SETUP delivery. - README.md: background on reverse engineering, notes about emulator limitations due to MFi chip requirements, description of the vulnerable AES CTR key-size assumption, and operational constraints (won’t work when PIN/pairing is required; exploitation beyond crash requires bypassing stack protections/leaks).
Repository contains a single Python proof-of-concept (LiberationPlay.py) plus a README describing research context. The script implements a minimal RTSP client over raw TCP sockets to target AirPlay/CarPlay receivers affected by CVE-2025-24132 ("AirBourne"). Core flow in LiberationPlay.py: - Connects to a user-specified device IP and port (author notes RTSP commonly on 7000, sometimes 5000). - Performs a heuristic device check: sends POST /diag-info and interprets status codes; if 200 is returned (some non-SDK devices respond 200 to anything), it then GETs /airbourne expecting 404 on official SDK implementations. - Sends POST /auth-setup with an application/octet-stream body consisting of a leading 0x01 byte plus a hardcoded Curve25519 public key (borrowed from PyATV) to set up server state. - Sends a crafted RTSP SETUP request with Content-Type: application/x-apple-binary-plist and a binary plist body containing an oversized encryption key field (ekey = 0xFF repeated 128 times) and et=16. This is intended to trigger the AES-CTR key update overflow described in the README (overflow in 16-byte blocks when key length is a multiple of 16). Exploit capability: as implemented, it is a crash/DoS PoC (no RCE). The script reports whether the socket closes/no response (interpreted as crash) or whether a response is received (possibly patched target or additional authorization/pairing required). The README notes that PIN/pairing flows are not implemented and that the overflowed data is XORed/needs correct encryption, complicating shellcode/RCE.
This repository provides a comprehensive proof-of-concept (PoC) exploit framework for two Apple AirPlay vulnerabilities: CVE-2025-24252 (mDNS TXT Record Crash) and CVE-2025-24132 (Heap Overflow leading to RCE). The main script, 'airborne.py', allows the user to select which CVE to exploit. For CVE-2025-24252, it sends a malformed mDNS packet to the multicast address 224.0.0.251 on UDP port 5353, causing a crash in the AirPlayReceiver daemon. For CVE-2025-24132, it exploits a heap overflow on TCP port 7000 to inject a base64-encoded reverse shell payload (bash, python, or PowerShell) into the target, providing the attacker with a shell. The script can also append the payload to the target's ~/.bashrc file for persistence. The secondary script, 'airborne_bash_command_injector.py', is a streamlined version for injecting arbitrary bash commands via the heap overflow vector. The repository is well-documented, with a README explaining usage, payload options, and ethical considerations. No hardcoded IPs or domains are present, but the exploit targets specific network ports and the AirPlay service. The code is operational, providing real exploitation capabilities with optional persistence.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability in AirPlay SDK affecting third-party devices, enabling zero-click compromise of smart speakers and CarPlay systems.
A remote code execution vulnerability in Apple CarPlay (AirPlay/iAP2 protocol) that can be exploited without user interaction, allowing attackers to take over CarPlay systems in vehicles.
A stack-based buffer overflow in AirPlay components/SDK that could enable zero-click remote code execution on AirPlay speakers/receivers, and can be chained with other AirBorne flaws for wormable exploitation scenarios.
A zero-click remote code execution vulnerability affecting third-party devices using the AirPlay SDK; described as potentially wormable and enabling eavesdropping.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.