A heap‑based buffer overflow exists in the function webinspector_receive_with_timeout within src/webinspector.c of libimobiledevice. The vulnerability, identified as CWE‑119 and CWE‑122, can be triggered remotely and may allow an attacker to execute arbitrary code or crash the host application that uses the library. The public exploit demonstrates that remote exploitation is feasible without special conditions.

All releases of the libimobiledevice library up to and including version 1.4.0 are affected. The vulnerability arises in the Web Inspector component that handles remote inspection traffic; any system employing this library without patching is vulnerable.

The CVSS score of 5.3 indicates moderate severity. The vulnerability is not listed in the CISA KEV catalog. An exploit is publicly available and can be launched remotely via the Web Inspector's network interface. Attackers can potentially gain code execution privileges on the machine running libimobiledevice by sending crafted data over its exposed interface.