The Apple Lossless Audio Codec has been free software since October 2011 and is subject to the Apache licence[...].
This has enabled this function to be embedded in many devices and programmes, including Android-based smartphones, Linux and Windows media players and converters. Apple updated the proprietary version of its decoder several times and fixed security vulnerabilities. The common code, on the other hand, has not been updated since 2011. It is vulnerable to attacks. Qualcomm and MediaTek used vulnerable ALAC code in audio decoders in more than half of all smartphones worldwide. At the end of 2021, 48 per cent of all Android phones sold in the US were powered by MediaTek, while Qualcomm has a 47 per cent market share there. Remote code execution (RCE) attacks allow malicious code to be executed remotely. MediaTek assigned CVE-2021-0674 and CVE-2021-0675 to the ALAC issues, Qualcomm released a patch for CVE-2021-30351 at the end of 2021[3].