CVE-2026-116262

libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based overflow

View on CVE.org
Published Oct 26, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A heap‑based buffer overflow exists in the function webinspector_receive_with_timeout within src/webinspector.c of libimobiledevice. The vulnerability, identified as CWE‑119, CWE‑122, and CWE‑787, can be triggered remotely and may allow an attacker to execute arbitrary code or crash the host application that uses the library. The public exploit demonstrates that remote exploitation is feasible without special conditions.

Affected Systems

All releases of the libimobiledevice library up to and including version 1.4.0 are affected. The vulnerability arises in the Web Inspector component that handles remote inspection traffic; any system employing this library without patching is vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The vulnerability is not listed in the CISA KEV catalog. An exploit is publicly available and can be launched remotely via the Web Inspector's network interface. Attackers can potentially gain code execution privileges on the machine running libimobiledevice by sending crafted data over its exposed interface.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install the latest libimobiledevice release that contains the heap buffer overflow fix, addressing the CWE‑119, CWE‑122, and CWE‑787 weaknesses.
  • If a patched release is not yet available, disable the Web Inspector component or block its listening socket to remove the remote interface that can be exploited.
  • Enforce strict input validation for all data received through Web Inspector; implement bounds checks to guarantee that incoming buffer sizes do not exceed the allocated memory, mitigating the CWE‑119 and CWE‑122 conditions.
  • Use network segmentation or firewall rules to restrict remote access to the Web Inspector service, thereby limiting exposure to the vulnerable interface.

Generated by OpenCVE AI on October 27, 2026 at 08:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Weaknesses CWE-787
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based overflow
First Time appeared Libimobiledevice
Libimobiledevice libimobiledevice
Weaknesses CWE-119
CWE-122
CPEs cpe:2.3:a:libimobiledevice:libimobiledevice:*:*:*:*:*:*:*:*
Vendors & Products Libimobiledevice
Libimobiledevice libimobiledevice
References
Metrics cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-122

    Heap-based Buffer Overflow

  • CWE-787

    Out-of-bounds Write

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 26, 2026, 4:16 PM
Reserved
Oct 25, 2026, 5:44 PM

View source JSON

Updated
Oct 26, 2026, 3:59 PM

JSON

Status
Deferred
Published
Oct 26, 2026, 12:17 PM
Modified
Oct 26, 2026, 5:17 PM

View source JSON

Severity
Moderate
Public date
Oct 26, 2026, 11:45 AM

View source Bugzilla JSON

Updated
Oct 27, 2026, 9:00 AM

JSON