Live › vulnerability › CVE-2026-116261
Go to dashboardA crafted argument to afc_file_open in libimobiledevice's AFC file handler causes an out-of-bounds read. The sources say the attack can be started remotely and that a public exploit exists, but they do not say what an attacker can read or whether code runs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 12:29 UTC. All times on this page are UTC.
Systems that run libimobiledevice and its AFC file handling code, typically tools that talk to iOS devices over the network or USB. The sources do not say which default configurations expose the AFC handler remotely, and they do not say whether the vendor has issued a patch.
No product ranges from the sources yet.
ideviceinfo --version or the package manager; versions up to 1.4.0 are listed as affected.1.4.0 once a fixed release is published; the sources do not name a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116261")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.