The vulnerable function afc_get_device_info_key in src/afc.c of libimobiledevice can be manipulated via the argument Value to overwrite arbitrary memory locations, causing memory corruption. This violation of bounds (CWE-119) may allow a local attacker to corrupt data or potentially hijack execution flow within the process. The CVSS score of 4.8 indicates a moderate severity, reflecting the local scope and impact on integrity and availability.

libimobiledevice versions up to and including 1.4.0 are affected. The vulnerability applies to the libimobiledevice library, regardless of the operating system or device, as long as the library is loaded and the afc_get_device_info_key function is reachable.

The CVSS score reflects a moderate risk, but the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires local access because the exploit is local and the source code is executed on the host. Publicly released exploits exist, so an attacker with local access could trigger memory corruption, potentially leading to denial of service or elevated privilege within the process context. The actual exploitation likelihood is uncertain due to the lack of EPSS data, but the ready availability of the exploit increases the urgency for remediation.