libimobiledevice contains a double free vulnerability in the AFC Service function service_receive. The flaw allows an attacker to corrupt memory when the function processes malformed input. If exploited, the attacker can gain arbitrary code execution on the host that runs the compromised libimobiledevice library. The vulnerability is the result of improper memory management as indicated by the associated CWE identifiers for memory corruption and double free.

The issue applies to libimobiledevice versions up to and including 1.4.0. Systems that employ this library, such as devices or utilities that rely on libimobiledevice for file transfer or device communication, are potentially affected if they have not upgraded beyond 1.4.0.

The CVSS score of 6.9 places the vulnerability at moderate severity. Although the EPSS score is not available, the public availability of an exploit and the remote attack vector increase the likelihood of real-world exploitation. The vulnerability is not currently listed in the CISA KEV catalog, but its potential to allow remote code execution warrants immediate attention.