Bug 2560609 (CVE-2026-116260)

Summary:	CVE-2026-116260 libimobiledevice: libimobiledevice: Denial of Service via double free in service_receive
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	rhel-process-autobot, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in libimobiledevice. A remote attacker could exploit a double-free vulnerability to cause a Denial of Service (DoS) or potentially achieve arbitrary code execution. By sending manipulated input to the service_receive function in the Apple File Conduit (AFC) service, an attacker can corrupt system memory and crash the application.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2564941, 2564943
Bug Blocks:

Description OSIDB Bzimport 2026-10-26 11:31:36 UTC

A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.