EUVD-2026-109778
GHSA-qq89-fhwv-p2xp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain low-privileged access to app using libimobiledevice ≤1.4.0
-
ExploitPresent malicious AFC peer or crafted input
-
ExecutionTrigger out-of-bounds read in afc_file_open
-
ImpactLeak adjacent process memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an application linked against libimobiledevice 1.0 through 1.4.0 that calls afc_file_open, plus an attacker-controlled or spoofed AFC endpoint (or crafted input) able to manipulate the bytes argument passed into that function; the CVSS vector requires low privileges (PR:L) and passive user interaction (UI:P). Limiting factors: impact is confined to low confidentiality (an out-of-bounds read / memory disclosure) with no integrity or availability impact, exploitation is not fully unauthenticated, and the exact trigger is not described in the available sources. As a client library rather than a listening service, realistic exposure depends on connecting to a hostile AFC peer. |
| Impact | Signals point to a moderate, non-urgent priority. The CVSS 4.0 base score is 5.1 (medium) and the vector limits impact to low confidentiality only (VC:L, VI:N, VA:N) with low privileges (PR:L) and passive user interaction (UI:P) required, consistent with an out-of-bounds read (CWE-125) that discloses adjacent memory rather than enabling code execution. The CVSS 4.0 Exploit Maturity is Proof-of-Concept (E:P), matching the input which shows a public PoC reference that is not verified as working exploit code; this is NOT confirmed active exploitation. The vuln.today decision label is this_month, so patch on a routine monthly cadence rather than as an emergency. Key data is missing or weak: there is no EPSS score, no CISA KEV listing (no evidence of in-the-wild exploitation), and because the vendor was contacted but did not respond there is no vendor advisory or confirmed fixed version. The 'remotely' claim from VulDB should be read cautiously - libimobiledevice is a client library for communicating with iOS devices, so realistic exposure is a malicious or spoofed AFC peer feeding crafted data to afc_file_open rather than an inbound network service; verify actual network reachability against your deployment. |
| Exploit ScenarioDerived | An attacker who can present a malicious or spoofed AFC (Apple File Conduit) peer, or supply crafted input to an application using libimobiledevice up to 1.4.0, triggers the out-of-bounds read in afc_file_open by manipulating the bytes argument. The read discloses a small amount of adjacent process memory (low confidentiality impact) and requires low privileges plus passive user interaction. A public PoC reference (a blog write-up) exists but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
An out-of-bounds read in libimobiledevice's AFC file handler can disclose a small amount of adjacent memory to a hostile or spoofed AFC peer. Applications linked against libimobiledevice 1.0 through 1.4.0 that call afc_file_open() are affected; the CVSS:4.0 vector rates confidentiality impact as low with no integrity or availability effect, and requires low privileges plus passive user interaction. A public write-up reference exists but is not verified as working exploit code, no CISA KEV entry or other active-exploitation signal is present, and priority is assessed as moderate and non-urgent.
RemediationAI
No vendor-released patch or fixed version is identified in the available data: the upstream project did not respond to the report, so no patched libimobiledevice release from 1.0 through 1.4.0 is confirmed, and there is no upstream advisory among the references (VulDB entry https://vuldb.com/vuln/426300 is the primary source). Updating cannot therefore be cited as a complete fix at this time and should be tracked against future libimobiledevice releases. Compensating measures follow from the exposure model: applications that do not need AFC file operations should avoid calling afc_file_open() against untrusted or spoofed AFC endpoints, since a malicious peer is the realistic attack path; validating or constraining the bytes/mode argument at the call site reduces the chance of an out-of-bounds condition being reached, at the cost of application changes; and limiting what a connecting peer can influence (for example pinning or otherwise verifying the device/endpoint before file operations) reduces exposure but does not remove the underlying read. Because impact is confined to low confidentiality with no integrity or availability effect, containment rather than emergency action is appropriate; the public write-up at https://bohmid-com.vercel.app/#/article/blog-afc-writeup is a reference and is not verified as working exploit code.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libimobiledevice is a cross-platform userspace client library that speaks Apple's proprietary lockdown and AFC (Apple File Conduit) protocols to iOS/iPadOS devices over USB or network connections. The vulnerable function, afc_file_open() in src/afc.c, is the AFC client-side call that requests a file handle from the AFC service running on the connected device, taking a path and a mode/bytes argument supplied by the calling application and serializing it into the AFC packet sent to the peer. CWE-125 (out-of-bounds read) means the code reads past the end of an allocated buffer while assembling or parsing that request, so memory contents beyond the intended buffer can be exposed. Because the flaw is exercised by the library as a client, the relevant exposure model is an application connecting to an attacker-controlled or spoofed AFC endpoint, or otherwise crafting input that manipulates the bytes argument, rather than a remotely reachable listening service. The CVSS:4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/E:P) as assessed translates to a low-privilege, network-reachable condition with passive user interaction and low confidentiality-only impact; the exact trigger sequence is not described in the available sources.
Know when Libimobiledevice gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Out-of-bounds read yields only low confidentiality impact (C:L, I/A:N); low privileges and user interaction are required (PR:L, UI:R), matching the supplied 4.0 metrics.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Libimobiledevice
View allA double free in the AFC service handler of libimobiledevice through 1.4.0 can be triggered when the client processes at
The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive informat
The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive inf
libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offs
The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors in
userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbit
The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass inten
The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap r
Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote
Exploit-DB