CVE-2026-116261: libimobiledevice AFC File afc.c afc_file_open out-of-bounds
A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afcfileopen of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which installations are in scope?
libimobiledevice versions up to and including 1.4.0 are identified as impacted. The affected component is the AFC File Handler.
What are the exploitation prerequisites?
The CVSS vector indicates that exploitation is network-reachable, requires low privileges, and requires user interaction. The vulnerability is rated as having low confidentiality impact, with no integrity or availability impact indicated.
Is exploit code publicly available?
The vulnerability information states that an exploit has been publicly disclosed and may be used. The CVSS vector also marks exploit maturity as proof-of-concept.