CVE-2026-116258
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In libimobiledevice up to 1.4.0, an unknown part of src/afc.c (AFC component) contains a heap-based buffer overflow. The attack can be executed remotely, and a public exploit is available. The vendor did not respond to the disclosure.
Risk Assessment
A remote attacker can exploit the heap-based buffer overflow, potentially leading to a crash or possible code execution. The risk applies to systems communicating with untrusted devices or services.
Recommendation
Limit exposure of services using libimobiledevice and monitor for a vendor patch. Until a fix is available, consider running in an isolated environment and filtering traffic.
Other vulnerabilities in libimobiledevice
See all- CVE-2026-116262Medium
A vulnerability was detected in libimobiledevice up to 1.4.0 in the webinspector_receive_with_timeout function of src/webinspector.c within the Web Inspector component. The manipulation results in a heap-based buffer overflow, and the attack can be launched remotely. The exploit is public and may be used; the vendor did not respond.
- CVE-2026-116261Low
A security vulnerability has been detected in libimobiledevice up to version 1.4.0. It affects the afc_file_open function in src/afc.c within the AFC File Handler component. Manipulation of the bytes argument leads to an out-of-bounds read, and the attack can be initiated remotely.
- CVE-2026-116260High
A weakness has been identified in libimobiledevice up to 1.4.0 affecting the service_receive function of src/afc.c in the AFC Service component. Manipulation can lead to a double free, the attack may be performed remotely, and the exploit is publicly available.
- CVE-2026-116259Medium
In libimobiledevice up to 1.4.0, the function afc_get_device_info_key in src/afc.c (Device Info Handler component) has a flaw where manipulation of the Value argument results in memory corruption. The attack requires local access, and a public exploit has been released. The vendor did not respond to the disclosure.
Original NVD description (English source)
A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS