Apple Releases Security Updates for Multiple Products

Apple has released security updates to address two exploited zero-day vulnerabilities in multiple Apple products.

Additionally, on 29 April 2025 security researchers published technical details for the 'AirBorne' vulnerability chain in Apple AirPlay. Three vulnerabilities from the AirBorne chain have been added to this cyber alert. If CVE-2025-24252, CVE-2025-24132, and CVE-2025-24206 are chained together, the researchers were reportedly able to achieve 'zero-click' remote code execution.

• CVE-2025-31200 is an 'out-of-bounds write' vulnerability with a CVSSv3 score of 7.5. If exploited, an unauthorised attacker could process an audio stream in a maliciously crafted media file to achieve code execution on the device. This vulnerability is under exploitation.

• CVE-2025-31201 is an 'insufficient information' vulnerability with a CVSSv3 score of 6.8. If exploited, an attacker with arbitrary read and write capability could bypass pointer authentication (PAC). This vulnerability is under exploitation.

• CVE-2025-24252 is a 'use-after-free' vulnerability in AirPlay with a CVSSv3 score of 9.8. If exploited an attacker on the local network could corrupt process memory. This vulnerability is part of the 'AirBorne' exploit chain.

• CVE-2025-24132 is a vulnerability in the AirPlay software development kit (SDK). If exploited an attacker on the local network could cause an unexpected app termination. This vulnerability is part of the 'AirBorne' exploit chain.

• CVE-2025-24206 is an 'incorrect authorisation' vulnerability in AirPlay with a CVSSv3 score of 7.7. If exploited an attacker on the local network could bypass authentication policy. This vulnerability is part of the 'AirBorne' exploit chain.