libimobiledevice EUVD-2026-109775

Exploitation requires local access (AV:L) and low-level privileges (PR:L) on a system running libimobiledevice up to 1.4.0, and the attacker must reach the afc_get_device_info_key function in the Device Info Handler (src/afc.c) and supply a manipulated 'Value' argument; no user interaction is required (UI:N). Limiting factors: there is no remote or unauthenticated path, the attacker must already have a local foothold with privileges, and the resulting impact is Low across confidentiality, integrity, and availability rather than full compromise. The specific configuration, calling context, or device interaction needed to reach the vulnerable function is not described in the available sources, so the exact trigger conditions beyond 'manipulation of the argument Value' cannot be confirmed.

All decision signals point to low real-world risk. The input CVSS 4.0 base score is 1.9 and the vuln.today priority Decision label is 'monitor', the lowest urgency tier - this is a high-attention bug class (memory corruption, CWE-119) but a low-severity instance. The vector is local (AV:L), low attack complexity (AC:L), and requires privileges (PR:L), so it is not remotely reachable and not unauthenticated; the three impact metrics are all Low (VC:L/VI:L/VA:L, SC:N/SI:N/SA:N), indicating constrained rather than full memory-corruption consequences. Exploit maturity is E:P (Proof-of-Concept), consistent with the description's claim that an exploit was released and with a public blog writeup reference. This is NOT confirmed active exploitation: there is no CISA KEV listing. No EPSS probability was supplied in the input, so widespread-exploitation likelihood cannot be quantified - this absence is a data gap, not evidence of safety. The main caveat is that the vendor was contacted but did not respond, so no vendor advisory, patch, or fixed version is available to confirm scope or remediation. Net: a genuine but low-priority local memory-corruption issue, appropriately in 'monitor' rather than act-now triage.

A local attacker with low privileges on a host using libimobiledevice (up to 1.4.0) supplies a manipulated 'Value' argument to afc_get_device_info_key in the Device Info Handler (src/afc.c), triggering memory corruption with limited (Low) confidentiality, integrity, and availability impact. A public proof-of-concept reference (a third-party blog writeup) exists and the CVSS exploit maturity is Proof-of-Concept, but it is not independently verified as working, weaponized exploit code. Because the vector is local and requires privileges (AV:L/PR:L), no remote or unauthenticated path is indicated.