---
id: "CVE-2026-116258"
kind: "vulnerability"
aliases: ["CVE-2026-116258"]
title: "libimobiledevice: heap buffer overflow in AFC lets remote attacker corrupt memory"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ios", "libimobiledevice", "linux", "macos", "package"]
not_affected_if: []
published_at: "2026-10-26T11:16:37+00:00"
first_seen_at: "2026-10-26T11:29:41+00:00"
updated_at: "2026-10-26T11:30:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116258", "first_seen_at": "2026-10-26T11:29:41+00:00"}]
---

# libimobiledevice: heap buffer overflow in AFC lets remote attacker corrupt memory

libimobiledevice up to 1.4.0 has a heap-based buffer overflow in the AFC component of src/afc.c. A remote attacker can trigger it, and a public exploit exists, so memory corruption and possibly code execution are the risk.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed libimobiledevice version with `ideviceinfo --version` or the package manager, and compare it against the affected range up to `1.4.0`.
- Look for the AFC code in src/afc.c if building from source.

## Timeline

- 2026-10-26T11:29:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116258

## From the sources

A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_