CVE-2026-116260
libimobiledevice AFC Service afc.c service_receive double free
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 26, 2026
- Updated
- Oct 31, 2026
- Reserved
- Oct 25, 2026
Description
A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 3.0 | 7.3 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
libimobiledevicen/a |
|
References
- VDB-426299 | libimobiledevice AFC Service afc.c service_receive double freevdb-entrytechnical-description
- VDB-426299 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-116260 | CVE Analysis and Reportthird-party-advisory
- Submit #1009969 | libimobiledevice fa0f79190142bc309307967c058f89c1b36eb6b8 - version 1.4.0 Double Freethird-party-advisory
- https://bohmid-com.vercel.app/#/article/blog-afc-writeupexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.