What’s Vulnerable › Vulnerabilities

CVE-2017-6438

• Severity: high (CVSS 7.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-03-15 · updated 2026-06-17
• Weakness: CWE-787

Description

Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) and possibly code execution via a crafted plist file.

Affected products

• Libplist Project Libplist: 1.12

References

• http://www.securityfocus.com/bid/97281
• https://github.com/libimobiledevice/libplist/issues/98
• http://www.securityfocus.com/bid/97281
• https://github.com/libimobiledevice/libplist/issues/98

Get alerted when CVE-2017-6438 or the next vulnerability affects your stack