UBUNTU-CVE-2026-116259: Low severity ubuntu/libimobiledevice vulnerability
A security flaw has been discovered in libimobiledevice up to 1.4.0. This vulnerability affects the function afcgetdeviceinfokey of the file src/afc.c of the component Device Info Handler. Performing a manipulation of the argument Value results in memory corruption. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attack requires local access and low privileges. No user interaction is required.
What is the potential impact if exploitation succeeds?
Successful manipulation of the Value argument in afc_get_device_info_key can cause memory corruption. The listed impact includes low confidentiality, integrity, and availability effects.
Is exploit code available?
Yes. The exploit has been publicly released and may be used in attacks.
Which versions are identified as affected?
The issue is reported in libimobiledevice up to version 1.4.0.