CVE-2026-116260: libimobiledevice AFC Service afc.c service_receive double free
A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function servicereceive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
Installations using libimobiledevice version 1.4.0 or earlier are affected, specifically where the AFC Service component is in use.
What does an attacker need to exploit the issue?
The issue can be attacked remotely. The supplied vector indicates no privileges or user interaction are required.
How should this be prioritized?
Prioritize it as high severity: public exploit material is available, and successful exploitation can affect confidentiality, integrity, and availability. The vendor was contacted but did not respond, and no remediation information is provided.