CVE-2026-116261

A flaw was found in libimobiledevice. This out-of-bounds read vulnerability allows a remote attacker to cause unauthorized information disclosure. By supplying manipulated input parameters to the Apple File Conduit (AFC) file opening routine, an attacker can cause the application to read memory past designated buffer boundaries.

An out-of-bounds read vulnerability was found in libimobiledevice in the afc_file_open function of src/afc.c. By supplying manipulated input parameters to the Apple File Conduit (AFC) file opening routine, an attacker who has an established/paired device session (PR:L) and user interaction (UI:R) can cause the application to read memory past designated buffer boundaries, resulting in unauthorized information disclosure. The upstream CNA lists versions up to 1.4.0 as affected with no fixed release available; the shipped versions (rhel-6 0.9.7, rhel-7/rhel-8 1.2.0) all fall within that affected scope, so the all-UNKNOWN version checks corroborate rather than negate affectedness.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No upstream fix is currently available. Exposure can be reduced by restricting libimobiledevice use to trusted, explicitly paired devices and avoiding interactions with untrusted device sessions until a fixed upstream release becomes available.