A buffer overflow vulnerability in the Apple AirPlay audio and video SDKs permits an attacker to cause a crash of the application handling the audio or video stream, resulting in a denial of service. The weakness is a classic stack-based buffer overflow (CWE-120), which can be triggered by supplying a specially crafted input to the SDK’s processing routine.

Affected products are Apple AirPlay audio SDK and AirPlay video SDK. The vulnerability is fixed in AirPlay audio SDK version 2.7.1 and AirPlay video SDK version 3.6.0.126. Devices or systems using older versions of either SDK are susceptible.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of less than 1 % suggests low probability of exploitation at the current time. The vulnerability has not been listed in the CISA KEV catalog. The likely attack vector is a local network attacker who can reach the device running the SDK and send malicious data. If exploited, the attacker can disrupt service but has no direct path to remote code execution or data compromise based on the current description.