{"id":"CVE-2026-116262","kind":"vulnerability","aliases":["CVE-2026-116262"],"related":[],"title":"libimobiledevice: heap overflow in Web Inspector receive path enables remote attack","description":"A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"libimobiledevice up to 1.4.0 has a heap-based buffer overflow in the webinspector_receive_with_timeout function of src/webinspector.c. A remote attacker can trigger it, and the exploit is public, but the sources do not say whether this gives code execution.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ios-tooling","libimobiledevice","package","self-hosted"],"not_affected_if":["not-using-libimobiledevice"],"how_to_check":"- Check the installed libimobiledevice version with `ideviceinfo --version` or your package manager (unknown if the sources give a command)\n- Confirm whether the Web Inspector component is in use on the host (unknown)","fix":"- Move to a libimobiledevice release newer than `1.4.0` once the vendor ships one (unknown: the sources do not name a fixed version)\n- The vendor did not respond to disclosure, so no official patch is confirmed (unknown)","status":"open","published_at":"2026-10-26T12:17:06+00:00","first_seen_at":"2026-10-26T12:29:53+00:00","triaged_at":"2026-10-26T12:31:44+00:00","updated_at":"2026-10-26T12:31:44+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-26T12:31:44Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a libimobiledevice release newer than `1.4.0` once the vendor ships one (unknown: the sources do not name a fixed version)\n- The vendor did not respond to disclosure, so no official patch is confirmed (unknown)","reach":"internet","title":"libimobiledevice: heap overflow in Web Inspector receive path enables remote attack","impact":"high","summary":"libimobiledevice up to 1.4.0 has a heap-based buffer overflow in the webinspector_receive_with_timeout function of src/webinspector.c. A remote attacker can trigger it, and the exploit is public, but the sources do not say whether this gives code execution.","category":"package","nicknames":[],"who_cares":["libimobiledevice","ios-tooling","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Heap memory corruption that may let a remote attacker run code","analyst_note":"Check the NVD entry and the upstream libimobiledevice repository for a fixed version, whether the flaw yields code execution, and the auth or network requirements for the Web Inspector service.","how_to_check":"- Check the installed libimobiledevice version with `ideviceinfo --version` or your package manager (unknown if the sources give a command)\n- Confirm whether the Web Inspector component is in use on the host (unknown)","needs_analyst":true,"not_affected_if":["not-using-libimobiledevice"],"who_is_affected":"Teams that build or run software linking libimobiledevice up to 1.4.0 and use its Web Inspector receive path, typically tooling that talks to iOS devices from a host machine. Systems that do not ship or run libimobiledevice can skip it. Whether a default install exposes the vulnerable function remotely is unknown from the sources.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00066,"input_tokens":3340,"output_tokens":652,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116262':14A,17A '-2026':13A,16A '1.4.0':29B,76C 'affect':78C 'attack':11A,48B,111C 'base':34B,102C 'buffer':35B,103C 'code':66B 'compon':93C 'contact':125C 'cve':12A,15A 'detect':71C 'disclosur':129C 'earli':126C 'element':79C 'enabl':9A 'execut':67B 'exploit':54B,114C 'file':89C 'function':43B,82C 'give':65B 'heap':2A,33B,101C 'heap-bas':32B,100C 'host':25B 'inspector':6A,95C 'io':19B 'ios-tool':18B 'launch':109C 'libimobiledevic':1A,21B,26B,73C 'manipul':97C 'may':119C 'overflow':3A,36B,104C 'packag':22B 'path':8A 'possibl':107C 'public':56B,117C 'receiv':7A,40B,84C 'remot':10A,47B,112C 'respond':133C 'result':98C 'say':62B 'self':24B 'self-host':23B 'sourc':59B 'src/webinspector.c':45B,90C 'timeout':42B,86C 'tool':20B 'trigger':50B 'use':121C 'vendor':123C 'vulner':69C 'way':136C 'web':5A,94C 'webinspector':39B,83C 'whether':63B","nicknames":[],"mitigations":[],"who_affected":"Teams that build or run software linking libimobiledevice up to 1.4.0 and use its Web Inspector receive path, typically tooling that talks to iOS devices from a host machine. Systems that do not ship or run libimobiledevice can skip it. Whether a default install exposes the vulnerable function remotely is unknown from the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T12:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116262","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116262","severity":null,"published_at":"2026-10-26T12:17:06+00:00","modified_at":"2026-10-26T12:17:06+00:00","first_seen_at":"2026-10-26T12:29:53+00:00","fetched_at":"2026-10-26T12:29:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}