CVE-2026-116259
libimobiledevice Device Info afc.c afc_get_device_info_key memory corruption
- State
- Published
- Severity
- 4.8 Medium
- Published
- Oct 26, 2026
- Updated
- Oct 26, 2026
- Reserved
- Oct 25, 2026
Description
A security flaw has been discovered in libimobiledevice up to 1.4.0. This vulnerability affects the function afc_get_device_info_key of the file src/afc.c of the component Device Info Handler. Performing a manipulation of the argument Value results in memory corruption. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 3.0 | 5.3 Medium | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 2.0 | 4.3 Medium | AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
- CWE-119 Memory Corruption
Affected Products
| Product | Versions |
|---|---|
libimobiledevicen/a |
|
References
- VDB-426298 | libimobiledevice Device Info afc.c afc_get_device_info_key memory corruptionvdb-entrytechnical-description
- VDB-426298 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-116259 | CVE Analysis and Reportthird-party-advisory
- Submit #1009968 | libimobiledevice fa0f79190142bc309307967c058f89c1b36eb6b8 - version 1.4.0 Memory corruptionthird-party-advisory
- https://bohmid-com.vercel.app/#/article/blog-afc-writeupexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.