{"id":"CVE-2026-116261","kind":"vulnerability","aliases":["CVE-2026-116261"],"related":[],"title":"libimobiledevice: AFC file open flaw reads memory out of bounds","description":"A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"A crafted argument to afc_file_open in libimobiledevice's AFC file handler causes an out-of-bounds read. The sources say the attack can be started remotely and that a public exploit exists, but they do not say what an attacker can read or whether code runs.","severity":"medium","cvss":4.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ios-tooling","libimobiledevice","linux","macos","package"],"not_affected_if":["no-libimobiledevice-installed"],"how_to_check":"- Check the installed version with `ideviceinfo --version` or the package manager; versions up to `1.4.0` are listed as affected.\n- unknown","fix":"- Move past `1.4.0` once a fixed release is published; the sources do not name a fixed version.\n- unknown","status":"open","published_at":"2026-10-26T12:17:06+00:00","first_seen_at":"2026-10-26T12:29:53+00:00","triaged_at":"2026-10-26T12:31:48+00:00","updated_at":"2026-10-26T12:31:48+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T12:31:48Z","model":"claude-haiku-5-5","output":{"fix":"- Move past `1.4.0` once a fixed release is published; the sources do not name a fixed version.\n- unknown","reach":"internet","title":"libimobiledevice: AFC file open flaw reads memory out of bounds","impact":"low","summary":"A crafted argument to afc_file_open in libimobiledevice's AFC file handler causes an out-of-bounds read. The sources say the attack can be started remotely and that a public exploit exists, but they do not say what an attacker can read or whether code runs.","category":"package","nicknames":[],"who_cares":["libimobiledevice","ios-tooling","linux","macos"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker reads process memory beyond the buffer bounds","analyst_note":"Confirm the affected code path, whether the AFC handler is reachable over the network by default, what memory an attacker can read, and whether any fixed release exists; the NVD entry is the only source given.","how_to_check":"- Check the installed version with `ideviceinfo --version` or the package manager; versions up to `1.4.0` are listed as affected.\n- unknown","needs_analyst":true,"not_affected_if":["no-libimobiledevice-installed"],"who_is_affected":"Systems that run libimobiledevice and its AFC file handling code, typically tools that talk to iOS devices over the network or USB. The sources do not say which default configurations expose the AFC handler remotely, and they do not say whether the vendor has issued a patch.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000611,"input_tokens":3349,"output_tokens":552,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116261':13A,16A '-2026':12A,15A '1.4.0':83C 'afc':2A,28B,34B,88C,98C 'argument':26B,105C 'attack':48B,66B,120C 'bound':10A,42B,112C 'byte':106C 'caus':37B 'code':71B 'compon':97C 'contact':135C 'craft':25B 'cve':11A,14A 'detect':78C 'disclos':126C 'disclosur':139C 'earli':136C 'exist':58B 'exploit':57B,123C 'file':3A,29B,35B,89C,93C,99C 'flaw':5A 'function':87C 'handler':36B,100C 'impact':84C 'initi':118C 'io':18B 'ios-tool':17B 'lead':107C 'libimobiledevic':1A,20B,32B,80C 'linux':21B 'maco':22B 'manipul':102C 'may':129C 'memori':7A 'open':4A,30B,90C 'out-of-bound':39B,109C 'packag':23B 'possibl':116C 'public':56B,127C 'read':6A,43B,68B,113C 'remot':52B,121C 'respond':143C 'run':72B 'say':46B,63B 'secur':74C 'sourc':45B 'src/afc.c':94C 'start':51B 'tool':19B 'use':131C 'vendor':133C 'vulner':75C 'way':146C 'whether':70B","nicknames":[],"mitigations":[],"who_affected":"Systems that run libimobiledevice and its AFC file handling code, typically tools that talk to iOS devices over the network or USB. The sources do not say which default configurations expose the AFC handler remotely, and they do not say whether the vendor has issued a patch.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T12:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116261","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116261","severity":null,"published_at":"2026-10-26T12:17:06+00:00","modified_at":"2026-10-26T12:17:06+00:00","first_seen_at":"2026-10-26T12:29:53+00:00","fetched_at":"2026-10-26T12:29:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}