CVE-2026-116262 libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based overflow
MediumCVSS 5.3
EPSS 0.32%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/libimobiledevice(Red Hat:rhel_els:7) | All versions | No fix listed |
| redhat/libimobiledevice(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| libimobiledevice | = 1.0 | No fix listed |
| libimobiledevice | = 1.1 | No fix listed |
| libimobiledevice | = 1.2 | No fix listed |
| libimobiledevice | = 1.3 | No fix listed |
| libimobiledevice | = 1.4.0 | No fix listed |
| debian/libimobiledevice(Debian:12) | All versions | No fix listed |
| debian/libimobiledevice(Debian:12) | = 1.3.0+git20240701-1 | No fix listed |
| debian/libimobiledevice(Debian:12) | = 1.3.0+git20240701-1~exp1 | No fix listed |
| debian/libimobiledevice(Debian:12) | = 1.3.0+git20240701-2 | No fix listed |
| debian/libimobiledevice(Debian:12) | = 1.3.0+git20240701-3 | No fix listed |
| debian/libimobiledevice(Debian:12) | = 1.3.0+git20240701-4 | No fix listed |
| debian/libimobiledevice(Debian:12) | = 1.3.0+git20250228-1 | No fix listed |
| debian/libimobiledevice(Debian:12) | = 1.3.0+git20250228-2 | No fix listed |
| debian/libimobiledevice(Debian:12) | = 1.3.0+git20250907-1 | No fix listed |
| debian/libimobiledevice(Debian:12) | = 1.3.0-6 | No fix listed |
| debian/libimobiledevice(Debian:12) | = 1.3.0-7 | No fix listed |
| debian/libimobiledevice(Debian:12) | = 1.3.0-7.1 | No fix listed |
| debian/libimobiledevice(Debian:12) | = 1.3.0-8 | No fix listed |
| debian/libimobiledevice(Debian:12) | = 1.3.0-8.1 | No fix listed |
| debian/libimobiledevice(Debian:12) | = 1.4.0-1 | No fix listed |
| debian/libimobiledevice(Debian:13) | All versions | No fix listed |
| debian/libimobiledevice(Debian:13) | = 1.3.0+git20250228-2 | No fix listed |
| debian/libimobiledevice(Debian:13) | = 1.3.0+git20250907-1 | No fix listed |
Show 9 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libimobiledevice(Debian:13) | = 1.4.0-1 | No fix listed |
| debian/libimobiledevice(Debian:14) | All versions | No fix listed |
| debian/libimobiledevice(Debian:14) | = 1.3.0+git20250228-2 | No fix listed |
| debian/libimobiledevice(Debian:14) | = 1.3.0+git20250907-1 | No fix listed |
| debian/libimobiledevice(Debian:14) | = 1.4.0-1 | No fix listed |
| ubuntu/libimobiledevice(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/libimobiledevice(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/libimobiledevice(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/libimobiledevice(Ubuntu:26.10) | All versions | No fix listed |
References
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2560628 issue-tracking
- www.cve.org
- nvd.nist.gov
- bohmid-com.vercel.app exploit
- CVE-2026-116262 | CVE Analysis and Report third-party-advisory
- Submit #1009972 | libimobiledevice fa0f79190142bc309307967c058f89c1b36eb6b8 - version 1.4.0 heap leak third-party-advisory
- VDB-426301 | libimobiledevice Web Inspector webinspector.c webinspector_receive_with_timeout heap-based overflow technical-description vdb-entry
- VDB-426301 | CTI Indicators (IOB, IOC, IOA) permissions-required signature
- Debian Security Tracker CVE-2026-116262 vendor-advisory
- Ubuntu CVE tracker vendor-advisory