CVE-2026-116260

libimobiledevice AFC Service afc.c service_receive double free

View on CVE.org
Published Oct 26, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

libimobiledevice contains a double free vulnerability in the AFC Service function service_receive. The flaw allows an attacker to corrupt memory when the function processes malformed input. If exploited, the attacker can gain arbitrary code execution on the host that runs the compromised libimobiledevice library. The vulnerability is the result of improper memory management as indicated by the associated CWE identifiers for memory corruption and double free.

Affected Systems

The issue applies to libimobiledevice versions up to and including 1.4.0. Systems that employ this library, such as devices or utilities that rely on libimobiledevice for file transfer or device communication, are potentially affected if they have not upgraded beyond 1.4.0.

Risk and Exploitability

The CVSS score of 6.9 places the vulnerability at moderate severity. Although the EPSS score is not available, the public availability of an exploit and the remote attack vector increase the likelihood of real-world exploitation. The vulnerability is not currently listed in the CISA KEV catalog, but its potential to allow remote code execution warrants immediate attention.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade libimobiledevice to a version newer than 1.4.0 that contains the double‑free fix
  • If an update is not yet available, disable or the AFC service component until a patch is released
  • Apply additional input validation or sandboxing measures to limit the impact of malformed AFC traffic

Generated by OpenCVE AI on October 27, 2026 at 06:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Weaknesses CWE-1341
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Description A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title libimobiledevice AFC Service afc.c service_receive double free
First Time appeared Libimobiledevice
Libimobiledevice libimobiledevice
Weaknesses CWE-119
CWE-415
CPEs cpe:2.3:a:libimobiledevice:libimobiledevice:*:*:*:*:*:*:*:*
Vendors & Products Libimobiledevice
Libimobiledevice libimobiledevice
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-1341

    Multiple Releases of Same Resource or Handle

  • CWE-415

    Double Free

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 31, 2026, 1:14 AM
Reserved
Oct 25, 2026, 5:44 PM

View source JSON

Updated
Oct 31, 2026, 1:14 AM

JSON

Status
Deferred
Published
Oct 26, 2026, 12:17 PM
Modified
Oct 31, 2026, 2:17 AM

View source JSON

Severity
Important
Public date
Oct 26, 2026, 11:15 AM

View source Bugzilla JSON

Updated
Oct 27, 2026, 7:00 AM

JSON