Remote CarPlay Hack Puts Drivers at Risk of Distraction and Surveillance

SecurityWeek reports that researchers have disclosed a remote CarPlay attack that could let attackers spy on drivers or distract them. According to AirBorne, vulnerabilities in Apple’s AirPlay/SDK could be exploited for remote code execution and other attacks, with CVE-2025-24132 enabling wormable zero-click exploits.

The attack chain can begin with Bluetooth pairing to the car’s iAP2-based CarPlay system, after which an attacker can obtain Wi‑Fi credentials and connect to the car hotspot to trigger the vulnerability and gain root access. Once inside, the attacker could take over the display, play audio, eavesdrop on conversations, or track the vehicle’s location.

Apple patched CVE-2025-24132 in late April, but according to the piece, only a few vendors have included the patch and no car manufacturers are confirmed to have applied it, leaving many vehicles potentially exposed after an official fix exists. The article notes delays across head-unit suppliers and automakers in adapting patched code, creating a long tail of exposure for vehicles well after a fix is released.