Heap-based buffer overflow in libimobiledevice AFC service
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Deferred Red Hat: fix deferred
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
libimobiledevice up to 1.4.0 contains a heap-based buffer overflow in the AFC component in src/afc.c, classified as CWE-122. A remote attacker with low privileges can trigger the overflow, corrupting heap memory. A public exploit is available. The vendor did not respond to early contact about the disclosure.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | libimobiledevice | 1.0; 1.1; 1.2; 1.3; 1.4.0 | — | No fix listed | CNA |
- libimobiledevice Vendor— Affected 1.0; 1.1; 1.2; 1.3; 1.4.0 Fixed in — No fix listed CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libimobiledevice:libimobiledevice:*:*:*:*:*:*:*:* | — | — | libimobiledevice |
- cpe:2.3:a:libimobiledevice:libimobiledevice:*:*:*:*:*:*:*:* Versions — — ·libimobiledevice
Remediation
The sources list no fixed version for libimobiledevice. Red Hat lists Red Hat Enterprise Linux 7 and Red Hat Enterprise Linux 8 as affected, with no fix plan available.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat Enterprise Linux 6
Timeline
- 2026-10-26 Threatist record created from CVE-2026-116258
- 2026-10-27 Alias added: GHSA-pvmf-fpv3-m5qh
- 2026-11-02 Affected versions changed · Red Hat
- 2026-11-02 CVSS score added · Red Hat
- 2026-11-02 CISA SSVC decision points changed
- 2026-11-02 Priority changed: LOW → MEDIUM
References
Sources
- CVE-2026-116258 · CVE Program
- CVE-2026-116258 · NVD
- FIRST EPSS
- GHSA-pvmf-fpv3-m5qh · GitHub Advisory Database · CC BY 4.0
- CVE-2026-116258 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences