CVE-2025-24132

Published Apr 30, 2025 CVSS 3.1 · 6.5 Medium EPSS 3.2% KEV · Not listed

Description

The issue was addressed with improved memory handling. This issue is fixed in AirPlay audio SDK 2.7.1 and AirPlay video SDK 3.6.0.126. An attacker on the local network may cause an unexpected app termination.

Analysis

Technical impact

The vulnerability is a memory handling error that can cause applications using Apple AirPlay audio or video SDKs to crash unexpectedly. It is classified as a buffer handling issue, identified as CWE‑119. The impact is a denial of service: an attacker can trigger application termination but cannot execute code or obtain sensitive information.

Affected Systems

Apple’s AirPlay audio SDK and AirPlay video SDK are affected. The fix is in audio SDK version 2.7.1 and video SDK version 3.6.0.126. Devices that rely on these SDKs and have older versions are at risk until the update is applied.

Risk and Exploitability

The CVSS score is 6.5, indicating moderate severity. The EPSS score is 3%, reflecting a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a local network attacker who can communicate with the device or application using the vulnerable SDK. No elevated privileges or internet exposure are required; local proximity is sufficient to trigger a crash.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Apple

AirPlay audio SDK

affected

Version	Status	Constraints
`0`	affected	< 2.7.1

Apple

AirPlay video SDK

affected

Version	Status	Constraints
`0`	affected	< 2.7.1

Configuration 1 [-]

OR	cpe:2.3:a:apple:airplay_audio_software_development_kit::::::::
	cpe:2.3:a:apple:airplay_video_software_development_kit::::::::
	cpe:2.3:a:apple:carplay_communication_plug-in::::::::

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to AirPlay audio SDK 2.7.1 or later
Upgrade to AirPlay video SDK 3.6.0.126 or later
Rebuild or redeploy applications that include the SDKs to ensure the new versions are in use

Generated by OpenCVE AI on June 18, 2026 at 07:05 UTC.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2025-12774	The issue was addressed with improved memory handling. This issue is fixed in AirPlay audio SDK 2.7.1, AirPlay video SDK 3.6.0.126, CarPlay Communication Plug-in R18.1. An attacker on the local network may cause an unexpected app termination.

Metrics

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 3.2% (3.193% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://support.apple.com/en-us/122403

History

Jun 18, 2026 4:45 PM Title updated View changes

Type	Values Removed	Values Added
Title	Local Denial of Service via Improper Memory Handling in Apple AirPlay Audio and Video SDKs

Jun 17, 2026 5:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		Local Denial of Service via Improper Memory Handling in Apple AirPlay Audio and Video SDKs

Jun 16, 2026 6:30 AM Title updated View changes

Type	Values Removed	Values Added
Title	Memory Handling Vulnerability Causing Application Crash via Local Network Attack

Apr 28, 2026 2:30 AM Title updated View changes

Type	Values Removed	Values Added
Title		Memory Handling Vulnerability Causing Application Crash via Local Network Attack

Apr 2, 2026 8:30 PM Description updated View changes

Type	Values Removed	Values Added
Description	The issue was addressed with improved memory handling. This issue is fixed in AirPlay audio SDK 2.7.1, AirPlay video SDK 3.6.0.126, CarPlay Communication Plug-in R18.1. An attacker on the local network may cause an unexpected app termination.	The issue was addressed with improved memory handling. This issue is fixed in AirPlay audio SDK 2.7.1 and AirPlay video SDK 3.6.0.126. An attacker on the local network may cause an unexpected app termination.

May 12, 2025 8:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Apple Apple airplay Audio Software Development Kit Apple airplay Video Software Development Kit Apple carplay Communication Plug-in
CPEs		cpe:2.3:a:apple:airplay_audio_software_development_kit:::::::: cpe:2.3:a:apple:airplay_video_software_development_kit:::::::: cpe:2.3:a:apple:carplay_communication_plug-in::::::::
Vendors & Products		Apple Apple airplay Audio Software Development Kit Apple airplay Video Software Development Kit Apple carplay Communication Plug-in

May 1, 2025 2:15 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-119
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 30, 2025 9:00 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		The issue was addressed with improved memory handling. This issue is fixed in AirPlay audio SDK 2.7.1, AirPlay video SDK 3.6.0.126, CarPlay Communication Plug-in R18.1. An attacker on the local network may cause an unexpected app termination.
References		https://support.apple.com/en-us/122403