AirBorne: Wormable zero-click remote code execution (RCE) in AirPlay protocol

Running a parser for a network protocol as root seems like a pretty unnecessarily dumb thing to do. I can't really imagine why any part of airplay would need to run as root; maybe something to do with DRM? Although the DRM daemon `fairplayd` runs as a limited-privilege user `_fpsd`, so maybe not. So bizarre that Apple makes all these cool systems to sandbox code, and creates dozens of privilege-separated users on macOS, and then runs an HTTP server doing plists parsing as an unsandboxed root process.

CVE-2025-24252 and CVE-2025-24132 are two examples. Doing a search for &quot;Oligo&quot; in release notes gives various other results, e.g.,<p>* <a href="https:&#x2F;&#x2F;support.apple.com&#x2F;en-ca&#x2F;122374" rel="nofollow">https:&#x2F;&#x2F;support.apple.com&#x2F;en-ca&#x2F;122374</a><p>Apple fixed their stuff, but third-parties who used their SDK will have to issue updates as well.

Zero-click local network RCE on macOS: 102 points<p>Article titled &quot;Someone At YouTube Needs Glasses&quot; about YouTube layout: 837 points and rising<p>Hacker News my a*s

macos is pretty promiscuous, and I&#x27;ve noticed random airplay displays (like the neighbors) showing up in the mirroring dropdown in the dock.<p>wonder if this is a way to get into the stack.

Very curious about the exploitation of CVE-2025-24252, a use-after-free (UAF) using which they achieved zero-click RCE on MacOS. This is inspite of ASLR and heap exploitation mitigations in place to mitigate such vulnerability classes<p><a href="https:&#x2F;&#x2F;security.apple.com&#x2F;blog&#x2F;towards-the-next-generation-of-xnu-memory-safety&#x2F;" rel="nofollow">https:&#x2F;&#x2F;security.apple.com&#x2F;blog&#x2F;towards-the-next-generation-...</a>

Oof. It&#x27;s parsing and memory corruption again.

Basically a collection of use-after-free, stack-based buffer overflow, type confusion, memory exhaustion, integer overflow, NULL pointer dereference, for the most part.<p>However we all know that the problem is that juniors and interns are the ones that get to write this code, a senior with proper education would never deliver these mistakes into production. &#x2F;s

Good thing I&#x27;m still on macOS 12

The most important question remains unanswered: would Rust have prevented this?