usbmuxd CVE-2025-66004

Requires an existing local, unprivileged user account on a host where the usbmuxd daemon is installed and running (typical on Linux systems used to sync/connect Apple iOS devices via libimobiledevice). Exploitation abuses usbmuxd's handling of attacker-influenced paths (CWE-35) to break out of its intended directory. Limiting factors that reduce real-world risk: there is NO remote vector (AV:L) so the attacker must already be on the box; the gained privileges are those of the usbmuxd service user only, not root; and only versions before commit 3ded00c9985a5108cfc7591a309f9a23d57a8cba are affected, so patched builds are not exploitable. No special non-default configuration is named in the description beyond usbmuxd being present and active.

This is a genuinely moderate, not high, priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N) and score of 5.1 describe a local attack: an attacker must already have a foothold on the host, which eliminates remote mass-exploitation. The description's phrase 'allows local users to escalate to the service user' confirms the local-only nature and clarifies this is a privilege-escalation path-traversal (CWE-35), not a confidentiality breach - consistent with VC:N/VI:L/VA:L (integrity and availability impact, no confidentiality). Note a mild tension in the authentication signal: the vendor's vector sets PR:N, yet the description explicitly requires a 'local user' (i.e., an existing account), so in practice some local access is a precondition - this is a local post-compromise escalation primitive rather than a no-access-required flaw. All exploitation signals point to low real-world urgency: EPSS is 0.15% (4th percentile), the CVE is NOT in CISA KEV, and no public exploit code is referenced. Exploitation status: no public exploit identified at time of analysis. The impact ceiling is also limited - escalation is to the usbmuxd service user, not root/system, so this is a lateral/privilege-step rather than full compromise. Treat as routine patch-cycle work, prioritized on multi-user or shared hosts where local accounts are untrusted.

A local user with shell access on a Linux host running usbmuxd crafts a filesystem path containing traversal sequences that usbmuxd processes without proper sanitization, causing the daemon to read or write files outside its intended directory. By abusing this, the attacker manipulates files or state owned by the usbmuxd service user and escalates from their own low-privileged account to that service user's context. No public proof-of-concept is referenced, and the attack requires prior local access.