Loading vulnerability…
CVE-2025-24252 is a use-after-free vulnerability in Apple AirPlay, addressed by Apple with improved memory management. Apple’s advisory states that an attacker on the local network may be able to corrupt process memory. Supporting reporting from Oligo Security places this issue within the broader “AirBorne” set of AirPlay vulnerabilities and indicates the flaw affects Apple platforms including macOS, iOS, iPadOS, tvOS, and visionOS prior to the patched releases. The vulnerability is reachable over the local network via AirPlay-related traffic and, on its own, can cause process memory corruption; external reporting further states it can be chained with CVE-2025-24206 to achieve zero-click remote code execution on macOS in certain AirPlay receiver configurations.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository provides a proof-of-concept (PoC) exploit for CVE-2025-24252, a use-after-free vulnerability in Apple's AirPlayReceiver service affecting multiple Apple platforms (iOS, macOS, tvOS, visionOS) prior to their respective patched versions. The exploit is implemented in a single Python script (CVE-2025-24252.py) using the Scapy library to craft and send malformed mDNS (multicast DNS) packets with oversized TXT records to the multicast address 224.0.0.251 on UDP port 5353. The script repeatedly sends these packets over a specified Wi-Fi interface in monitor mode, targeting Apple devices on the same local network. The README provides detailed setup and usage instructions, including requirements for a Wi-Fi adapter in monitor mode and configuration steps. The exploit's purpose is to trigger a crash or memory corruption in the AirPlayReceiver service, confirming the presence of the vulnerability. No detection or post-exploitation features are present; the code is strictly a crash trigger PoC.
This repository provides a comprehensive proof-of-concept (PoC) exploit framework for two Apple AirPlay vulnerabilities: CVE-2025-24252 (mDNS TXT Record Crash) and CVE-2025-24132 (Heap Overflow leading to RCE). The main script, 'airborne.py', allows the user to select which CVE to exploit. For CVE-2025-24252, it sends a malformed mDNS packet to the multicast address 224.0.0.251 on UDP port 5353, causing a crash in the AirPlayReceiver daemon. For CVE-2025-24132, it exploits a heap overflow on TCP port 7000 to inject a base64-encoded reverse shell payload (bash, python, or PowerShell) into the target, providing the attacker with a shell. The script can also append the payload to the target's ~/.bashrc file for persistence. The secondary script, 'airborne_bash_command_injector.py', is a streamlined version for injecting arbitrary bash commands via the heap overflow vector. The repository is well-documented, with a README explaining usage, payload options, and ethical considerations. No hardcoded IPs or domains are present, but the exploit targets specific network ports and the AirPlay service. The code is operational, providing real exploitation capabilities with optional persistence.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A use-after-free memory corruption issue reachable by a local-network attacker on Apple Vision Pro.
A critical wormable zero-click RCE vulnerability in Apple AirPlay protocol, allowing autonomous spread across macOS devices on the same network.
A zero-click kernel overflow vulnerability in iOS exploited by Pegasus spyware to gain initial access and execute code without user interaction.
A zero-click kernel overflow vulnerability in iOS exploited by Pegasus spyware in November 2025, allowing remote code execution via a malicious iMessage with no user interaction required.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.