CVE-2026-116258

A flaw was found in libimobiledevice. A remote attacker can trigger a heap-based buffer overflow in the Apple File Conduit (AFC) component by sending specially crafted requests. Successful exploitation may result in a Denial of Service (DoS) through an application crash or memory corruption.

This vulnerability is rated as Moderate severity because exploitation requires an established Apple File Conduit session with a connected iOS device, limiting exposure to active file transfer interactions. In Red Hat Enterprise Linux environments, libimobiledevice is not configured as an exposed listening network service and is used client-side primarily within desktop installations to communicate with paired mobile hardware. A malicious or compromised device sending malformed responses can cause the client process to crash or corrupt memory, but it cannot compromise the system remotely without an active user connection.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Avoid connecting untrusted iOS devices to the host system.

If Apple device communication features are not required, remove the optional libimobiledevice package:

dnf remove libimobiledevice

Warning: Removing libimobiledevice may remove dependent desktop integration packages (such as gvfs-afc or related GNOME utilities) and disable Apple device interoperability. Systems remain fully accessible and manageable via terminal and command line.