Apple Products AirPlay Component Use-After-Free Vulnerability Allowing Memory Corruption

A use-after-free vulnerability has been identified in the AirPlay component of several Apple products, including macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4, iPadOS 18.4, and visionOS 2.4. This vulnerability allows an attacker on the local network to corrupt process memory, potentially leading to arbitrary code execution.

Impact

Exploitation of this vulnerability can cause process memory corruption, which may be leveraged for arbitrary code execution.

Reproduction

The vulnerability can be reproduced by sending a crafted AirPlay request over the local network to a vulnerable device. This can be done by an unauthenticated user on the same network as the target device.

Remediation

Users can update to the latest versions of macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4, iPadOS 18.4, and visionOS 2.4 to address this vulnerability.