CVE-2026-116262
Description
A flaw was found in libimobiledevice. A remote attacker can trigger a heap-based buffer overflow in the Web Inspector component by sending specially crafted input during packet processing in the webinspector_receive_with_timeout function. This issue can cause the application to crash, leading to a Denial of Service (DoS), or potentially result in memory corruption.
Statement
This vulnerability is rated as Moderate severity rather than Important because exploitation requires an established communication session with a targeted iOS device running the Web Inspector service, restricting the blast radius to client-initiated workflows. In Red Hat Enterprise Linux, libimobiledevice functions as a client-side library for Apple device communication and does not run as a persistent, unattended network daemon. A successful attack requires a local user or client application to actively connect to a compromised or malicious endpoint, preventing broad remote exploitation under standard deployments.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.4 | N/A | 5.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RC:C
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
