Apple CarPlay RCE Exploit Left Unaddressed in Most Cars

Apple CarPlay remains vulnerable to a zero-click RCE (CVE-2025-24132) despite a fix being available since April, with patches largely unimplemented by vendors and no car manufacturers yet applying them, nearly half a year on. According to The Bold Bureau via Alamy Stock Photo, researchers from Oligo Security disclosed a buffer overflow in CarPlay on 29 April 2025, assigning the vulnerability a CVSS score of 6.5 as a medium severity issue.

Exploitation can occur by USB or over the Internet, and in some configurations, Bluetooth “Just Works” pairing or predictable Wi‑Fi passwords can ease access, enabling an attacker to gain root privileges via the AirPlay SDK. The attack chain travels through Apple’s iAP2 protocol, which authenticates in only one direction, allowing an external device to masquerade as an iPhone and exfiltrate network credentials or issue commands to the vehicle.

Apple released a security update in April and coordinated disclosure with Oligo, but the automotive sector’s update cycles and coordination with suppliers have hampered widespread patch deployment. Researchers say the patching gap is not due to apathy alone, highlighting the broader challenges of standardisation, testing, and OTA update adoption in vehicles.