libimobiledevice CVE-2026-116262

Exploitation requires the host to run libimobiledevice ≤1.4.0 and establish a Web Inspector session whose peer (the iOS device's Web Inspector service) is attacker-controlled, spoofed, or compromised; the heap overflow is reached when webinspector_receive_with_timeout parses a crafted/oversized inbound message. Limiting factors: the victim host must initiate or accept the Web Inspector connection to the malicious peer, the vector requires some privilege (PR:L, consistent with a paired/trusted webinspector session) though no user interaction (UI:N), and the assessed impact is bounded (no confidentiality; only low integrity and availability). The sources do not describe the precise overflow trigger (length field, allocation size, or whether code execution is achievable), so impact beyond crash/corruption is unverified.

Signals point consistently to LOW real-world priority, which matches the vuln.today 'monitor' decision label. The supplied CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) yields a base score of only 2.1: no confidentiality impact and only low integrity/availability impact, with some privilege required (PR:L). It is NOT in CISA KEV (no confirmed active exploitation), and no EPSS score was provided in the input, so widespread-exploitation probability cannot be quantified here. The CVSS vector carries E:P (Proof-of-Concept), and the references include a public write-up, so exploit material exists but is not characterized as a verified weaponized exploit. One notable tension: the description claims 'It is possible to launch the attack remotely' and the vector is AV:N, yet libimobiledevice is a host-side client library that parses data received from an iOS device's Web Inspector service - so realistic exploitation depends on the host connecting to a malicious, spoofed, or compromised Web Inspector peer rather than an attacker reaching a listening service unprompted; verify this vector interpretation with the source, as it materially limits 'remote' reach. A second gap: this is a third-party (VulDB) disclosure and the vendor did not respond, so no vendor advisory, no CVSS validation, and no fixed version are available. Net: a genuine heap-based buffer overflow (CWE-119) but low assessed impact, privilege/peer prerequisites, niche product, and no KEV/EPSS corroboration make this a monitor-and-patch-when-available item, not an emergency.

A host runs a libimobiledevice (≤1.4.0) tool that opens a Web Inspector session, and an attacker who controls, spoofs, or has compromised the peer iOS device's Web Inspector service returns a crafted oversized response; webinspector_receive_with_timeout in src/webinspector.c mishandles the length and overflows a heap buffer, corrupting the client process's memory or crashing it. A public PoC/write-up reference exists, but it is not verified as working exploit code, and exploitation requires AC:L with an established session (PR:L) and no user interaction.