Get the latest tech news
AirBorne: Wormable zero-click remote code execution (RCE) in AirPlay protocol
Oligo Security reveals AirBorne, a new set of vulnerabilities in Apple’s AirPlay protocol and SDK. Learn how zero-click RCEs, ACL bypasses, and wormable exploits could endanger Apple and IoT devices worldwide — and how to protect yourself.
When CVE-2025-24271 is chained with CVE-2025-24137, it allows for a one-click RCE on MacOS devices that are connected to the same network as an attacker with the AirPlay receiver on and set to the “Current User” configuration. Examples of attack outcomes include distracting drivers through image display and playing audio, or potentially actions like eavesdropping on conversations and tracking a vehicle’s location. Examples of attack outcomes include distracting drivers through image display and playing audio, to more nefarious actions like eavesdropping on conversations and tracking a vehicle’s location.
Or read this on Hacker News