Your Car Is at Risk: New Flaw Grants Hackers Root Access to Apple CarPlay
Researchers at Oligo Security have uncovered a vulnerability in Apple CarPlay that enables remote code execution with root privileges, granting attackers full control over a vehicle’s multimedia system. The flaw, registered as CVE-2025-24132, resides in the AirPlay protocol implementation within CarPlay.
The issue affects AirPlay Audio SDK up to version 2.7.1, AirPlay Video SDK up to version 3.6.0.126, and the CarPlay Communication Plug-in up to release R18.1. The vulnerability was demonstrated at DefCon 33 during the presentation Pwn My Ride. Researchers showed that attackers could chain Bluetooth and Wi-Fi exploitation to penetrate a car’s system without driver interaction.
Wireless CarPlay relies on a protocol chain: iAP2 over Bluetooth establishes network parameters, while AirPlay over Wi-Fi mirrors the iPhone screen. The researchers discovered that a Bluetooth radio alone was sufficient to trigger the simplified “Just Works” pairing mode. From there, an attacker could obtain the SSID and password for CarPlay’s hidden Wi-Fi network and exploit a stack buffer overflow in AirPlay, ultimately enabling code execution at the kernel level.
Although Apple released patched SDKs on April 29, 2025, automotive manufacturers are notoriously slow to integrate such updates. For most models, remediation requires either a service center visit or manual installation via USB, leaving millions of vehicles exposed months after fixes were issued.
The researchers refrained from disclosing full exploitation details to allow vendors time to adapt their firmware. However, they confirmed successful root access across multiple CarPlay implementations. Wireless connections pose the greatest concern: unlike wired CarPlay, they allow remote attacks if executed within the short device-discovery window during pairing.
The fragmented automotive supply chain compounds the risk: carmakers, head-unit suppliers, middleware developers, and aftermarket integrators must each independently update SDKs, validate compatibility, and roll out firmware. While newer models with over-the-air update capability may receive patches faster, the majority of vehicles will remain vulnerable for an extended period.
Experts recommend that companies relying on CarPlay in fleet operations audit their firmware versions and enforce strict update policies. Automakers and hardware vendors, meanwhile, are urged to accelerate SDK integration and streamline validation processes to minimize exposure.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
