The vulnerability is an access issue that allows an unauthenticated user on the same local network as a signed‑in Apple device to send arbitrary AirPlay commands without pairing. Because AirPlay commands can control media playback and trigger actions on the target device, an attacker who can reach the local network could potentially gain remote command execution capability or otherwise manipulate the device’s behavior. The weakness is identified as an unauthorized access flaw (CWE‑306) compounded by improper handling of data formats (CWE‑843).

Apple iOS devices running 18.4, iPadOS devices running 18.4 or 17.7.6, macOS machines running Sequoia 15.4, Sonoma 14.7.5, or Ventura 13.7.5, tvOS 18.4, and visionOS 2.4 are affected.

The CVSS score of 5.4 indicates moderate severity. The EPSS score of less than 1% suggests a very low probability that this flaw will be exploited in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a local network attacker who does not need credentials and can simply send AirPlay commands after the target device signs in to a network. Exploitation requires the target to be reachable on the network and have AirPlay receiving enabled.