Wormable Zero-Click RCE in AirPlay Impacts Billions of Apple and IoT Devices

Wormable Zero-Click RCE in AirPlay Impacts Billions of Apple and IoT Devices

Speakers:

• Gal Elbaz — Co-founder and CTO, Oligo Security
• Avi (researcher) — AI Security Research Lead, Oligo Security
• Uri (researcher) — Research Lead (Airborne), Oligo Security

Conference: Black Hat USA 2025 — August 6-7, 2025, Mandalay Bay, Las Vegas

YouTube: https://www.youtube.com/watch?v=cNCSml35wLU

Reading Time: ~10 minutes

Type: Briefing

TL;DR

"Airborne" is a collection of 23 vulnerabilities — 17 assigned CVEs — in Apple's AirPlay protocol and the AirPlay SDK used by third-party IoT device manufacturers. The research produced the first-ever zero-click, wormable remote code execution on macOS, alongside unauthenticated RCE on Bose smart speakers and Pioneer in-car multimedia systems. More than 200,000 AirPlay-enabled devices are directly internet-exposed; billions more are reachable over local networks, Bluetooth, or browser-based access to port 7000.

Introduction

AirPlay is a 20-year-old Apple protocol, originally launched as AirTunes for audio streaming and later extended to video and imaging. It is ubiquitous: every modern Apple device runs it, and Apple licenses the protocol through an SDK to hundreds of third-party manufacturers spanning smart speakers, TVs, car multimedia systems, and other IoT devices. The attack surface is correspondingly vast.

Oligo Security researchers Gal, Avi, and Uri began investigating AirPlay through a prior research thread — their DEF CON 32 talk on "0.0.0.0 Day," which showed how browsers can communicate with locally running services through the address 0.0.0.0. While researching that issue, they found AirPlay's service listening on port 7000 and reachable from a browser context, which launched the investigation that culminated in "Airborne."

How AirPlay Works — and Why It Is Exposed

▶ Watch: AirPlay Protocol Architecture (04:00)

AirPlay uses mDNS (Multicast DNS) on port 5353 to announce device presence on a local network. Any device that joins the network and listens for a few seconds receives a complete inventory of every AirPlay-compatible device present — no port scanning required. The protocol itself runs over HTTP and RTSP on port 7000, using property list (plist) payloads in XML or binary format. Commands include pre-session discovery, authentication and session setup, and post-session media control.

The protocol is proprietary and its public documentation is either incomplete or outdated. Oligo's research required reverse engineering the AirPlay binary from the dyldcache on macOS to understand the full command set and authentication lifecycle.

Initial Findings: A Five-Minute Python Fuzzer

▶ Watch: First Findings with the Naive Fuzzer (08:02)

The researchers' initial fuzzer was deliberately simple — five nested Python loops iterating over plist field combinations. Despite its simplicity, it surfaced three significant findings:

1. Authentication bypass / missing pre-auth checks. Many AirPlay commands are supposed to require session authentication, but in practice they are accessible without any authentication or established session. One impact: playing arbitrary full-screen video on a target device without user interaction.

1. Syslog leak. A single unauthenticated Get Log command returns the full macOS system log, including boot time, hostname, username, and list of running processes.

1. FPSetup2 memory corruption crash. A single unauthenticated HTTP command crashes the macOS ControlCenter service. This specific crash was not directly exploitable, but its existence in a five-minute fuzzer confirmed that deeper analysis would find more.

All three findings were discovered before any reverse engineering took place. After reaching out to Apple and beginning coordinated disclosure, the researchers turned to binary analysis.

Reverse Engineering and Vulnerability Classes

▶ Watch: Reverse Engineering AirPlay Binaries (12:03)

Two vulnerability classes dominated the reverse engineering phase:

Type confusion: The AirPlay HTTP handler constructs plist objects from user-supplied request bodies and passes them to functions that expect a specific type — typically a dictionary via CFDictionaryGetValue. Supplying a string or integer in place of a dictionary crashes the process. In other code paths, type confusion leads to exploitable memory corruption.

Null dereference: Certain session-phase commands implicitly assume a session object has been initialized. Because many commands skip the authentication/session-setup check, calling them without a valid session results in a null pointer dereference and process crash.

Sixteen vulnerabilities were reported to Apple at this stage. The team was temporarily blocked by Apple's bug submission system for submitting too many reports too quickly.

SDK Vulnerability: Stack Buffer Overflow on IoT Devices

When the research expanded to the AirPlay SDK used by third-party manufacturers, the team found a stack buffer overflow — a class of vulnerability that should be vanishingly rare in 2025, yet here it is.

▶ Watch: Exploiting the AirPlay SDK — Bose Speaker and Pioneer Car System (16:03)

Before purchasing any hardware, the team simulated the firmware of SDK-based devices using an emulation setup. Confirming exploitability in simulation meant money was not wasted on non-exploitable hardware. Two devices were ultimately demonstrated:

• Bose home speaker: Root shell obtained via the stack overflow. The researchers downloaded an image from the internet and displayed it on the speaker's screen to illustrate arbitrary code execution — but stressed that root access means persistence, network pivoting, and potential use as a permanent listening device in homes or conference rooms.

• Pioneer CarPlay multimedia system: The same stack overflow, with minor exploit adaptation, achieved root on a head unit placed in the researchers' office. With GPS on the unit, an attacker could track vehicles, disrupt navigation displays, or compromise in-car systems.

The stack overflow CVE is described by Apple as potentially resulting in "unexpected app termination" — language that significantly undersells the true impact. Many IoT devices using the SDK are not yet patched and may never receive patches, as third-party vendors have no update mechanism comparable to Apple's.

macOS Use-After-Free: The Zero-Click Wormable RCE

The most impactful finding is a use-after-free vulnerability in the FairPlay decryption stack on macOS — the first zero-click, wormable RCE ever demonstrated on a MacBook.

▶ Watch: Use-After-Free and macOS Zero-Click Demo (22:04)

The FairPlay methods in AirPlay are highly obfuscated; the team reconstructed function names from headers and GitHub snippets. The vulnerability follows a classic pattern: the FairPlay decryption context is stored in a global pointer. If decryption fails, the context is freed via a teardown function — but the global pointer is not zeroed. A subsequent reference to that global pointer accesses freed memory. Apple's heap implementation lacks heap spray protection at this code path, allowing the freed memory to be reallocated and controlled by the attacker.

With write-what-where capability on the heap, the researchers could overwrite function pointers in the ControlCenter process — the process that hosts AirPlay on macOS — and redirect execution to arbitrary code.

The attack was made zero-click by a separate finding: a flag in the AirPlay command structure that marks the connecting client as a "remote control." When this flag is set, the user-facing "Allow this device to stream to your Mac?" pop-up is suppressed, bypassing the only user interaction barrier. Apple assigned a separate CVE to the authentication bypass.

Attack Vectors and Scale

▶ Watch: Attack Vectors — Internet, LAN, Browser, Proximity (24:04)

Oligo identified four distinct attack vectors:

1. Public internet: At least 200,000 AirPlay-enabled devices are indexed by Shodan and Censys with AirPlay services directly internet-exposed.

1. Same network (LAN): Attackers on the same Wi-Fi — including corporate offices, hotels, and airports — can use mDNS auto-discovery to enumerate targets and attack without additional reconnaissance.

1. Browser-based: Port 7000 is reachable from a web browser context (as demonstrated in the prior 0.0.0.0 Day research). Certain vulnerabilities can be triggered by visiting a malicious webpage.

1. Physical proximity (Bluetooth): Apple maintains proprietary interfaces that always listen on Apple devices. An attacker within Bluetooth range — in a coffee shop, airport, or conference venue — can reach AirPlay without being on the same network.

Disclosure and Patching Status

Apple received responsible disclosure and worked closely with Oligo to coordinate fixes. The SDK vulnerabilities complicate the picture: Apple has robust auto-update infrastructure, but third-party IoT vendors are responsible for their own firmware. Some devices will never receive patches. Cisco is specifically called out as one vendor with delayed fixes; many others are similarly situated.

Recommendations for defenders:

• Update all Apple devices to the versions that include the Airborne patches.
• Disable the AirPlay receiver on any device not actively used for casting media.
• Set AirPlay access to "current user" if AirPlay must remain enabled — this setting drastically reduces the accessible attack surface.
• Block port 7000 at the network firewall or router level to eliminate AirPlay exposure network-wide.

Notable Quotes

"This is the first zero-click wormable RCE on MacBook ever, and it affects billions of devices worldwide."

— Gal Elbaz [00:00]

"We found out that at least two hundred thousand of them are facing the internet. At least two hundred thousand devices."

— Avi [26:04]

"When was the last time you updated your speaker?"

— Avi [28:05]

"Not my code equals not my responsibility — in the end, Apple did an amazing work for their devices, but there are a lot of other vendors that might not even know that they are infected."

— Gal Elbaz [34:07]

Key Takeaways

• AirPlay's attack surface is far larger than Apple devices alone. The SDK is embedded in hundreds of IoT products from dozens of manufacturers, most of which lack Apple's update infrastructure.
• 200,000+ devices are directly internet-exposed via Shodan/Censys-indexed AirPlay services, with billions more reachable on local networks.
• The zero-click authentication bypass was a single flag. Setting the remote control client type suppresses the user consent pop-up, turning a one-click attack into a zero-click wormable exploit.
• IoT devices are persistent footholds. A compromised smart speaker or car multimedia system can be used for network reconnaissance, eavesdropping, and lateral movement — and users rarely update them.
• Disable AirPlay if you are not using it. The receiver surface is significant and unnecessary for devices not intended to receive cast media.
• The 23-vulnerability count reflects a systemic issue. Finding this many bugs in a widely deployed proprietary protocol suggests that similar protocols merit similar scrutiny.

Slides were not listed as available for this talk.