Live › vulnerability › CVE-2026-116262
Go to dashboardlibimobiledevice up to 1.4.0 has a heap-based buffer overflow in the webinspector_receive_with_timeout function of src/webinspector.c. A remote attacker can trigger it, and the exploit is public, but the sources do not say whether this gives code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 12:29 UTC. All times on this page are UTC.
Teams that build or run software linking libimobiledevice up to 1.4.0 and use its Web Inspector receive path, typically tooling that talks to iOS devices from a host machine. Systems that do not ship or run libimobiledevice can skip it. Whether a default install exposes the vulnerable function remotely is unknown from the sources.
No product ranges from the sources yet.
ideviceinfo --version or your package manager (unknown if the sources give a command)1.4.0 once the vendor ships one (unknown: the sources do not name a fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116262")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.