CVE-2026-116260

A flaw was found in libimobiledevice. A remote attacker could exploit a double-free vulnerability to cause a Denial of Service (DoS) or potentially achieve arbitrary code execution. By sending manipulated input to the service_receive function in the Apple File Conduit (AFC) service, an attacker can corrupt system memory and crash the application.

Red Hat has rated this vulnerability as having an Important severity impact because memory corruption from double-free conditions can be triggered over the network without authentication, potentially resulting in arbitrary code execution or service disruption. In standard Red Hat Enterprise Linux deployments, libimobiledevice is primarily utilized in workstation or desktop environments for managing Apple mobile devices rather than in headless server installations. Exploitation requires an active connection exchanging data with an untrusted or malicious iOS endpoint over the Apple File Conduit service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If Apple device connectivity is not required, remove the optional libimobiledevice package to eliminate exposure:

dnf remove libimobiledevice

Warning: Removing libimobiledevice may remove dependent desktop components such as gvfs-afc or related GNOME packages, which disables iOS device integration in graphical environments. Terminal access and server functionality remain fully usable.

--- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to remove the libimobiledevice package or block untrusted network connections to the Apple File Conduit service: upgrade to the fixed Libimobiledevice builds, which apply the documented input check, closing all 2 injection vectors (manipulated AFC service network traffic, crafted responses from an untrusted iOS endpoint). Until patched, this is only a concern on Linux systems with libimobiledevice version 1.4.0 or earlier managing Apple mobile devices — Headless server installations not utilizing Apple mobile device management are unaffected — so Remove libimobiledevice if iOS connectivity is unnecessary, and avoid exchanging data with untrusted or malicious endpoints over the Apple File Conduit service. As a compensating measure, Randomize userspace memory layout to prevent reliable address resolution during heap corruption, Enforce SELinux policy to confine the execution domain of the libimobiledevice process, Deploy endpoint detection agents to detect anomalous process behavior and crash artifacts, Use eBPF runtime monitoring to detect shell spawns or abnormal system calls, Block unauthorized physical USB endpoint connections from untrusted iOS devices, and Enforce non-executable heap memory to prevent code execution within corrupted pages. These controls limit blast radius and contain exploitation, but they do not fix the underlying double-free defect — apply the upstream patch to fully remediate.

Highest-impact CME: CME-101 ASLR (Address Space Layout Randomization) (medium)