UBUNTU-CVE-2026-116260: Double Free

Published Oct 26, 2026

Updated

A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function servicereceive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

7 affected components

ubuntu/libimobiledevice*

Event History

Oct 26, 2026

CVE Published

via OSV·12:17 PM

Data Sourced

via OSV·12:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which libimobiledevice versions are affected?

The issue affects libimobiledevice versions up to and including 1.4.0. The provided information does not identify a fixed version.

Can this be exploited remotely without authentication or user interaction?

Yes. The supplied vector indicates network reachability, low attack complexity, no privileges required, and no user interaction required.

Is exploit code publicly available?

Yes. The vulnerability description states that a public exploit has been made available and could be used in attacks.

UBUNTU-CVE-2026-116260: Double Free

Affected Software

Event History

Frequently Asked Questions

Which libimobiledevice versions are affected?

Can this be exploited remotely without authentication or user interaction?

Is exploit code publicly available?

Company

Resources

Contact

Frequently Asked Questions

Which libimobiledevice versions are affected?

Can this be exploited remotely without authentication or user interaction?

Is exploit code publicly available?