A logic flaw related to state management allows an attacker on the same local network to circumvent the rate limit applied to AirPlay pairing code attempts. By repeatedly requesting pairing, a local attacker could exhaust the allowable attempts, potentially forcing legitimate users to re-enter pairing codes or leading to a denial of service scenario for AirPlay functionality. The vulnerability hinges on improper authorization controls over the pairing process, increasing the attack surface for unauthorized pairing attempts.

Apple devices covered by this issue include iOS, iPadOS, macOS, visionOS, and watchOS. The fix is implemented in iOS 18.7.12, 26.7.3, and 27.2.1; iPadOS 18.7.12, 26.7.3, and 27.2.1; macOS Golden Gate 27.2.1, Sequoia 15.8.3, and Tahoe 26.7.3; visionOS 27.2.1; watchOS 26.6.1 and 27.2.1. All other versions remain vulnerable and could be targeted by an attacker with network proximity.

The exploit requires a local network presence; no remote vectors are described. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly known exploitation at this time. However, because the flaw permits repeated pairing attempts without proper rate limiting, a determined local adversary could achieve significant disruption or potentially gain unauthorized access through forced pairing if additional weaknesses exist. The severity score is not provided, but the absence of KEV listing suggests a moderate risk pending broader detection or exploitation reports.