CVE-2026-116261Low· 3.5▾ SunlitA security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds rea…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 19.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
libimobiledevice 1.0libimobiledevice 1.1libimobiledevice 1.2libimobiledevice 1.3libimobiledevice 1.4.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116260High· 7.3libimobiledevice AFC Service afc.c service_receive double free
CVE-2026-116262Medium· 5.4libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based overflow
CVE-2026-116258Medium· 6.3libimobiledevice AFC afc.c heap-based overflow
CVE-2026-116259Medium· 5.3libimobiledevice Device Info afc.c afc_get_device_info_key memory corruption
CVE-2025-11840Low· 3.3A weakness has been identified in GNU Binutils 2.45
CVE-2025-11413Low· 3.3A vulnerability was found in GNU Binutils 2.45