CVE-2026-116259
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In libimobiledevice up to 1.4.0, the function afc_get_device_info_key in src/afc.c (Device Info Handler component) has a flaw where manipulation of the Value argument results in memory corruption. The attack requires local access, and a public exploit has been released. The vendor did not respond to the disclosure.
Risk Assessment
A local attacker can exploit the vulnerability to cause memory corruption, potentially leading to a crash or possible code execution in the process context. The risk applies to hosts with the vulnerable library installed.
Recommendation
Restrict local access to trusted users and monitor for a vendor patch. Until a fix is available, consider limiting use of libimobiledevice or running it in an isolated environment.
Other vulnerabilities in libimobiledevice
See all- CVE-2026-116262Medium
A vulnerability was detected in libimobiledevice up to 1.4.0 in the webinspector_receive_with_timeout function of src/webinspector.c within the Web Inspector component. The manipulation results in a heap-based buffer overflow, and the attack can be launched remotely. The exploit is public and may be used; the vendor did not respond.
- CVE-2026-116261Low
A security vulnerability has been detected in libimobiledevice up to version 1.4.0. It affects the afc_file_open function in src/afc.c within the AFC File Handler component. Manipulation of the bytes argument leads to an out-of-bounds read, and the attack can be initiated remotely.
- CVE-2026-116260High
A weakness has been identified in libimobiledevice up to 1.4.0 affecting the service_receive function of src/afc.c in the AFC Service component. Manipulation can lead to a double free, the attack may be performed remotely, and the exploit is publicly available.
- CVE-2026-116258Medium
In libimobiledevice up to 1.4.0, an unknown part of src/afc.c (AFC component) contains a heap-based buffer overflow. The attack can be executed remotely, and a public exploit is available. The vendor did not respond to the disclosure.
Original NVD description (English source)
A security flaw has been discovered in libimobiledevice up to 1.4.0. This vulnerability affects the function afc_get_device_info_key of the file src/afc.c of the component Device Info Handler. Performing a manipulation of the argument Value results in memory corruption. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS