Double Free Vulnerability in libimobiledevice AFC Service
CVE-2026-116260

6.9MEDIUM

Key Information:

Vendor

libimobiledevice

Status
Libimobiledevice
Vendor
CVE Published:
26 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-116260?

A vulnerability has been discovered in the AFC Service of libimobiledevice, specifically within the service_receive function in the afc.c file. This flaw could potentially allow an attacker to exploit double free conditions, which may lead to arbitrary code execution or application crashes. The attack can be conducted remotely, making it especially critical for users who have not updated to a secure version. Although the vendor was informed about this security issue, no response has been recorded, highlighting the urgency for users to apply available patches and be vigilant against potential attacks.

Affected Version(s)

libimobiledevice 1.0

libimobiledevice 1.1

libimobiledevice 1.2

References

https://vuldb.com/vuln/426299
vdb-entrytechnical-description
https://vuldb.com/vuln/426299/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-116260
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

ahmed0000 (VulDB User)
VulDB CNA Team
.