high7.5
CVE-2026-28815
A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentially causing a crash or…
Impact
A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentially causing a crash or memory disclosure depending on runtime protections. This issue is fixed in swift-crypto version 4.3.1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| swift | swift-crypto | >= 4.0.0, <= 4.3.0 | 4.3.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apple | Swift-Crypto | from 4.0.0 before 4.3.1 |