CVE-2025-24271

An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4 and iPadOS 18.4, visionOS 2.4. An unauthenticated user on the same network as a signed-in Mac could send it AirPlay commands without pairing.

Affected

Apple · iOS and iPadOS · iPadOS · macOS · tvOS · visionOS

CVSS v3.1 CNA

5.4 MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS

0.51% chance of exploitation in the next 30 days, 42nd percentile

Published

2025-04-29

Updated

2026-07-25

Proof-of-concept exploits (1)

• moften/CVE-2025-242714★ · 2025-04-30

Security advisories

• https://support.apple.com/en-us/122371
• https://support.apple.com/en-us/122372
• https://support.apple.com/en-us/122373
• https://support.apple.com/en-us/122374
• https://support.apple.com/en-us/122375
• https://support.apple.com/en-us/122377
• https://support.apple.com/en-us/122378

References

• CVE Record
• NVD entry

Related

• CVE-2014-6271
• CVE-2015-9251
• CVE-2018-15473
• CVE-2019-20372
• CVE-2021-21424
• CVE-2021-23017