CVE-2026-116262: libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based overflow
A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspectorreceivewithtimeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Deployments using libimobiledevice versions up to 1.4.0 should be reviewed, particularly where the Web Inspector component is reachable remotely.
What level of access does an attacker need?
The CVSS vector indicates that an attacker needs low privileges. No user interaction is required, and the attack can be launched remotely.
How serious is the potential impact?
The stated impact is low integrity impact and low availability impact, with no confidentiality impact indicated. A public exploit is available, which increases the likelihood of exploitation.