Live › vulnerability › CVE-2026-116260
Go to dashboardA double free in the service_receive function of src/afc.c in libimobiledevice up to 1.4.0 corrupts memory when a crafted manipulation is performed. A remote attacker can trigger it, and a public exploit exists, so the realistic worst case is a crash or code execution in the process using the library.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 12:29 UTC. All times on this page are UTC.
Systems that run libimobiledevice 1.4.0 or earlier to talk to iPhones and iPads, especially services that accept AFC traffic from devices or clients outside the operator's control. Desktop use on a trusted cable with no exposed service is a lower risk. The sources do not say which downstream tools bundle the library.
No product ranges from the sources yet.
ideviceinfo -v or the package manager, and look for anything at or below 1.4.0ldd $(which idevicebackup2) | grep imobiledevice) and check whether they expose AFC over a network service1.4.0 once a patched release is available; the sources do not name a fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116260")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.