Carplay Vulnerability Grants Remote Root Access Via Airplay Flaw - Arabian Post

(MENAFN- The Arabian Post) decoding="async" alt="" border="0" width="320" data-original-height="667" data-original-width="1000" src="https://i.ytimg.com/vi/y-z1sM0IkPs/maxresdefault.jpg" onerror="this.onerror=null;this.src='https://thearabianpost.com/assets/aparab-news-post.jpg?v3';" />

A newly revealed flaw in Apple's CarPlay ecosystem enables attackers to achieve remote code execution with root privileges, raising serious cybersecurity concerns for connected vehicles. Tracked as CVE-2025-24132 and identified by the Oligo Security Research team, the weakness stems from a stack-based buffer-overflow flaw in AirPlay protocol implementations used by CarPlay systems. It remains exploitable over Wi-Fi via a wormable, zero-click exploit-allowing attackers to take full control of vehicle infotainment systems without user interaction. The stack-based buffer overflow allows root RCE applies across wireless connections, Bluetooth-paired sessions and even USB connections.

Apple addressed the issue in updates to AirPlay audio SDK 2.7.1, AirPlay video SDK 3.6.0.126, and CarPlay Communication Plug-in R18.1, made available to MFi-registered vendors in late April 2025. Despite these fixes, Oligo reports that, as of today, no major automaker has applied the patches-a consequence of slow, fragmented and often manual vehicle update cycles.

Exploitation is alarmingly straightforward under specific conditions. Attackers may initiate Bluetooth pairing using the iAP2 protocol-often configured in“Just Works” mode with no PIN required-extract Wi-Fi credentials from the vehicle, connect to its hotspot, and then trigger the AirPlay flaw to gain root access. Alternative vectors include connecting via USB or exploiting predictable hotspot passwords.

The stakes are high: compromised CarPlay systems could display arbitrary content, play distracting audio, eavesdrop via microphones, or even leak vehicle location data-posing both safety and privacy risks. With CarPlay available in more than 800 vehicle models and millions of third-party AirPlay-enabled devices in use, the potential attack surface is considerable.

Industry experts emphasise that these AirPlay-based exploits could worm across networks, automatically compromising other devices in proximity once one device is infected.

See also Wikipedia's Legal Battle Shapes Online Safety Act Future

Manufacturers and end users are urged to apply security patches immediately upon availability. However, given that most vehicle update mechanisms are slow or require dealership visits, many CarPlay units remain exposed. In the meantime, risk mitigation strategies include disabling AirPlay receivers where possible, hardening network configurations, changing default Wi-Fi hotspot passwords, and restricting Bluetooth pairing modes.

This vulnerability underscores how stack-based buffer overflow enables root RCE across CarPlay systems-a sobering reminder that convenience features in connected vehicles can become critical security liabilities when left unpatched.

Notice an issue? Arabian Post strives to deliver the most accurate and reliable information to its readers. If you believe you have identified an error or inconsistency in this article, please don't hesitate to contact our editorial team at editor[at]thearabianpost[dot]com . We are committed to promptly addressing any concerns and ensuring the highest level of journalistic integrity.

MENAFN10092025000152002308ID1110044668