---
id: "CVE-2026-116261"
kind: "vulnerability"
aliases: ["CVE-2026-116261"]
title: "libimobiledevice: AFC file open flaw reads memory out of bounds"
severity: "medium"
cvss: 4.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ios-tooling", "libimobiledevice", "linux", "macos", "package"]
not_affected_if: ["no-libimobiledevice-installed"]
published_at: "2026-10-26T12:17:06+00:00"
first_seen_at: "2026-10-26T12:29:53+00:00"
updated_at: "2026-10-26T12:31:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116261", "first_seen_at": "2026-10-26T12:29:53+00:00"}]
---

# libimobiledevice: AFC file open flaw reads memory out of bounds

A crafted argument to afc_file_open in libimobiledevice's AFC file handler causes an out-of-bounds read. The sources say the attack can be started remotely and that a public exploit exists, but they do not say what an attacker can read or whether code runs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `ideviceinfo --version` or the package manager; versions up to `1.4.0` are listed as affected.
- unknown

## Fix

- Move past `1.4.0` once a fixed release is published; the sources do not name a fixed version.
- unknown

## Timeline

- 2026-10-26T12:29:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116261

## From the sources

A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_