Log in Start free

Vulnerability · Published Oct 26, 2026 · Assigned by VulDB

CVE-2026-116261libimobiledevice AFC File afc.c afc_file_open out-of-bounds

Low 3.5

In plain English

A low-severity out-of-bounds read in libimobiledevice. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.2%top 90.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libimobiledeviceno fix listedDEBIAN-CVE-2026-116261
Debian:13libimobiledeviceno fix listedDEBIAN-CVE-2026-116261
Debian:14libimobiledeviceno fix listedDEBIAN-CVE-2026-116261
Ubuntu:22.04:LTSlibimobiledeviceno fix listedUBUNTU-CVE-2026-116261
Ubuntu:24.04:LTSlibimobiledeviceno fix listedUBUNTU-CVE-2026-116261
Ubuntu:26.04:LTSlibimobiledeviceno fix listedUBUNTU-CVE-2026-116261
Ubuntu:26.10libimobiledeviceno fix listedUBUNTU-CVE-2026-116261

Affected products (as reported)

VendorProductVersions
n/a libimobiledevice 1.01.11.21.31.4.0

Weakness: CWE-125, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C

References