CVE-2025-8474 MEDIUM

CVE-2025-8474: Alpine iLX-507 CarPlay Stack-based Buffer Overflow Code Execution Vulnerability

Vendor Alpine
Product iLX-507
Weakness CWE-121
Published August 1, 2025
Last update August 1, 2025
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Physical
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Alpine iLX-507 CarPlay Stack-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the Apple CarPlay protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-26318.

Key dates

02Disclosure timeline

August 1, 2025 CVE published
August 1, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-7550 Tenda FH1201 GstDhcpSetSer fromGstDhcpSetSer stack-based overflow CVE-2021-1200 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Management Interface Remote Command Execution and Denial of Service Vulnerabilities CVE-2023-50234 Hancom Office Cell XLS File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability CVE-2023-6693 Qemu: virtio-net: stack buffer overflow in virtio_net_flush_tx() CVE-2023-35736 D-Link DAP-2622 DDP Change ID Password New Password Stack-based Buffer Overflow Remote Code Execution Vulnerability