CVE-2025-24271
First published: Tue Apr 29 2025(Updated: )
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4 and iPadOS 18.4, visionOS 2.4. An unauthenticated user on the same network as a signed-in Mac could send it AirPlay commands without pairing.
Credit: product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| macOS | ||
| tvOS | ||
| macOS Ventura | ||
| Apple iOS, iPadOS, and macOS | >=17.7.6<=18.4 | |
| Apple macOS | ||
| Apple iOS and iPadOS | ||
| visionOS | ||
| <17.7.6 | ||
| >=18.0<18.4 | ||
| <18.4 | ||
| <13.7.5 | ||
| >=14.0<14.7.5 | ||
| >=15.0<15.4 | ||
| <18.4 | ||
| <2.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-24271?
CVE-2025-24271 is classified as a medium severity vulnerability due to the unauthorized access risk it poses.
How do I fix CVE-2025-24271?
To address CVE-2025-24271, users should update their devices to the latest operating system versions: macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4, or visionOS 2.4.
Who is affected by CVE-2025-24271?
CVE-2025-24271 affects users of Apple products running the specified versions of macOS, tvOS, iPadOS, iOS, and visionOS.
What does CVE-2025-24271 exploit?
CVE-2025-24271 exploits an access issue allowing unauthenticated users on the same network to send AirPlay requests to targeted devices.
When was CVE-2025-24271 identified?
CVE-2025-24271 was identified and resolved with the release of updates in the spring of 2025.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/author
- agent/source
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/apple
- canonical/macos
- canonical/tvos
- canonical/macos ventura
- canonical/apple ios, ipados, and macos
- canonical/apple macos
- canonical/apple ios and ipados
- canonical/visionos
- version/apple ios, ipados, and macos/18.0
- canonical/iphone os
- version/macos/14.0
- version/macos/15.0