libimobiledevice CVE-2026-116258

Exploitation requires the AFC (Apple File Conduit) code path in libimobiledevice ≤1.4.0 to be exercised, i.e. the library actively communicating with an AFC endpoint and parsing its data in src/afc.c. Because the vulnerable code is the client side, an attacker must control the AFC peer - a malicious or compromised iOS device, or a rogue/man-in-the-middle AFC service - to return the crafted data; PR:L in the input is consistent with the paired/trusted device relationship AFC normally requires. Limiting factors: affected versions are ≤1.4.0 only, the AFC component must be in use, the attacker must sit on the device/peer side of the connection, and the input rates all impacts Low with no scope change. The precise configuration or data that triggers the overflow is not described in the available sources.

All signals point to a low real-world priority. The supplied CVSS 4.0 vector scores 2.1 with uniformly Low impact (VC:L/VI:L/VA:L) and no scope change (SC/SI/SA:N), and the vuln.today Decision label is 'monitor' - not act_now or emergency. Exploit maturity is E:P (proof-of-concept), consistent with the public PoC reference; there is no CISA KEV listing and no EPSS score in the input, so widespread or automated exploitation is not evidenced. One signal conflicts with the mechanism: the description says the attack 'can be executed remotely' and the vector uses AV:N, but the flaw is in src/afc.c of libimobiledevice, a client-side library that parses Apple File Conduit (AFC) data from a connected device - realistic exploitation therefore requires an attacker to control the AFC peer (a malicious or compromised iOS device, or a rogue AFC endpoint) rather than a classic unauthenticated network attack. This AV:N/'remote' framing should be verified against the actual trigger. The trigger mechanism beyond 'manipulation leads to heap-based buffer overflow' is not described in the available sources, so the practical severity of the overflow (crash vs. corruption) cannot be confirmed from the data.

An attacker who controls an AFC endpoint - a malicious or compromised iOS device, or a rogue AFC service a libimobiledevice ≤1.4.0 client connects to - returns crafted AFC data that is mishandled in src/afc.c, triggering a heap-based buffer overflow in the client. A public PoC reference (a blog writeup) exists but is not verified as working exploit code, and the CVSS impact is rated Low across confidentiality, integrity and availability. The exact trigger is not described in the available sources.