CVE-2026-116262
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A vulnerability was detected in libimobiledevice up to 1.4.0 in the webinspector_receive_with_timeout function of src/webinspector.c within the Web Inspector component. The manipulation results in a heap-based buffer overflow, and the attack can be launched remotely. The exploit is public and may be used; the vendor did not respond.
Risk Assessment
A heap-based buffer overflow can lead to crashes or potential arbitrary code execution. The public exploit and vendor silence increase risk.
Recommendation
Limit exposure of the Web Inspector component and monitor for libimobiledevice updates; consider compensating controls until a fix is released.
Other vulnerabilities in libimobiledevice
See all- CVE-2026-116261Low
A security vulnerability has been detected in libimobiledevice up to version 1.4.0. It affects the afc_file_open function in src/afc.c within the AFC File Handler component. Manipulation of the bytes argument leads to an out-of-bounds read, and the attack can be initiated remotely.
- CVE-2026-116260High
A weakness has been identified in libimobiledevice up to 1.4.0 affecting the service_receive function of src/afc.c in the AFC Service component. Manipulation can lead to a double free, the attack may be performed remotely, and the exploit is publicly available.
- CVE-2026-116259Medium
In libimobiledevice up to 1.4.0, the function afc_get_device_info_key in src/afc.c (Device Info Handler component) has a flaw where manipulation of the Value argument results in memory corruption. The attack requires local access, and a public exploit has been released. The vendor did not respond to the disclosure.
- CVE-2026-116258Medium
In libimobiledevice up to 1.4.0, an unknown part of src/afc.c (AFC component) contains a heap-based buffer overflow. The attack can be executed remotely, and a public exploit is available. The vendor did not respond to the disclosure.
Original NVD description (English source)
A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS