Amazon Linux 2 (EOS) Security Advisory: ALAS2-2026-4112
Advisory Released Date: 2026-11-12
Advisory Updated Date: 2026-11-12
Severity:
Important
Issue Overview:
A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. (CVE-2026-116258)
Affected Packages:
libimobiledevice
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update libimobiledevice or yum update --advisory ALAS2-2026-4112 to update your system.
New Packages:
aarch64:
libimobiledevice-1.2.0-1.amzn2.0.3.aarch64
libimobiledevice-devel-1.2.0-1.amzn2.0.3.aarch64
libimobiledevice-utils-1.2.0-1.amzn2.0.3.aarch64
libimobiledevice-python-1.2.0-1.amzn2.0.3.aarch64
libimobiledevice-debuginfo-1.2.0-1.amzn2.0.3.aarch64
i686:
libimobiledevice-1.2.0-1.amzn2.0.3.i686
libimobiledevice-devel-1.2.0-1.amzn2.0.3.i686
libimobiledevice-utils-1.2.0-1.amzn2.0.3.i686
libimobiledevice-python-1.2.0-1.amzn2.0.3.i686
libimobiledevice-debuginfo-1.2.0-1.amzn2.0.3.i686
src:
libimobiledevice-1.2.0-1.amzn2.0.3.src
x86_64:
libimobiledevice-1.2.0-1.amzn2.0.3.x86_64
libimobiledevice-devel-1.2.0-1.amzn2.0.3.x86_64
libimobiledevice-utils-1.2.0-1.amzn2.0.3.x86_64
libimobiledevice-python-1.2.0-1.amzn2.0.3.x86_64
libimobiledevice-debuginfo-1.2.0-1.amzn2.0.3.x86_64