{"id":"CVE-2026-116260","kind":"vulnerability","aliases":["CVE-2026-116260"],"related":[],"title":"libimobiledevice: double free in AFC service lets remote attackers crash or run code","description":"A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"A double free in the service_receive function of src/afc.c in libimobiledevice up to 1.4.0 corrupts memory when a crafted manipulation is performed. A remote attacker can trigger it, and a public exploit exists, so the realistic worst case is a crash or code execution in the process using the library.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ios","libimobiledevice","linux","package","self-hosted"],"not_affected_if":["no-libimobiledevice-installed","no-network-exposed-service"],"how_to_check":"- Check the installed libimobiledevice version with `ideviceinfo -v` or the package manager, and look for anything at or below `1.4.0`\n- Find programs that link the library (`ldd $(which idevicebackup2) | grep imobiledevice`) and check whether they expose AFC over a network service","fix":"- Move libimobiledevice past `1.4.0` once a patched release is available; the sources do not name a fixed version\n- Until then, stop exposing AFC-handling tools to untrusted or network-reachable devices and clients","status":"open","published_at":"2026-10-26T12:17:06+00:00","first_seen_at":"2026-10-26T12:29:53+00:00","triaged_at":"2026-10-26T12:31:40+00:00","updated_at":"2026-10-26T12:31:40+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T12:31:40Z","model":"claude-haiku-5-5","output":{"fix":"- Move libimobiledevice past `1.4.0` once a patched release is available; the sources do not name a fixed version\n- Until then, stop exposing AFC-handling tools to untrusted or network-reachable devices and clients","reach":"network","title":"libimobiledevice: double free in AFC service lets remote attackers crash or run code","impact":"high","summary":"A double free in the service_receive function of src/afc.c in libimobiledevice up to 1.4.0 corrupts memory when a crafted manipulation is performed. A remote attacker can trigger it, and a public exploit exists, so the realistic worst case is a crash or code execution in the process using the library.","category":"package","nicknames":[],"who_cares":["libimobiledevice","ios","self-hosted","linux"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker crashes the process or runs code within it","analyst_note":"Confirm the patched version and whether any fix exists; the source (NVD) gives no fixed release, vendor response, or affected-function trigger conditions.","how_to_check":"- Check the installed libimobiledevice version with `ideviceinfo -v` or the package manager, and look for anything at or below `1.4.0`\n- Find programs that link the library (`ldd $(which idevicebackup2) | grep imobiledevice`) and check whether they expose AFC over a network service","needs_analyst":true,"not_affected_if":["no-libimobiledevice-installed","no-network-exposed-service"],"who_is_affected":"Systems that run libimobiledevice 1.4.0 or earlier to talk to iPhones and iPads, especially services that accept AFC traffic from devices or clients outside the operator's control. Desktop use on a trusted cable with no exposed service is a lower risk. The sources do not say which downstream tools bundle the library.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":3327,"output_tokens":667,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116260':16A,19A '-2026':15A,18A '1.4.0':41B,87C 'afc':5A,102C 'affect':90C 'attack':9A,52B,113C,133C 'avail':124C 'case':65B 'code':13A,70B 'compon':101C 'contact':137C 'corrupt':42B 'could':129C 'craft':46B 'crash':10A,68B 'cve':14A,17A 'disclosur':141C 'doubl':2A,28B,110C 'earli':138C 'execut':71B,104C 'exist':60B 'exploit':59B,120C 'file':97C 'free':3A,29B,111C 'function':34B,92C 'host':26B 'identifi':82C 'io':20B 'issu':89C 'lead':108C 'let':7A 'libimobiledevic':1A,21B,38B,84C 'librari':77B 'linux':22B 'made':123C 'manipul':47B,106C 'may':114C 'memori':43B 'packag':23B 'perform':49B,116C 'process':74B 'public':58B,127C 'realist':63B 'receiv':33B,94C 'remot':8A,51B,118C 'respond':145C 'run':12A 'self':25B 'self-host':24B 'servic':6A,32B,93C,103C 'src/afc.c':36B,98C 'trigger':54B 'use':75B,131C 'vendor':135C 'way':148C 'weak':79C 'worst':64B","nicknames":[],"mitigations":[],"who_affected":"Systems that run libimobiledevice 1.4.0 or earlier to talk to iPhones and iPads, especially services that accept AFC traffic from devices or clients outside the operator's control. Desktop use on a trusted cable with no exposed service is a lower risk. The sources do not say which downstream tools bundle the library.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T12:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116260","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116260","severity":null,"published_at":"2026-10-26T12:17:06+00:00","modified_at":"2026-10-26T12:17:06+00:00","first_seen_at":"2026-10-26T12:29:53+00:00","fetched_at":"2026-10-26T12:29:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}