high7.5
CVE-2026-111923
Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash …
Impact
Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.
Affected products
| Product | Affected versions |
|---|---|
| Fleet | before 4.89.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.