7.5
High
CVE-2026-28815 A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C…
Description
A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentially causing a crash or memory disclosure depending on runtime protections. This issue is fixed in swift-crypto version 4.3.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| macOS 4.0 | 4.0.0 → < 4.3.1 | 4.3.1 |
Other CVEs of macOS
The 3813 CVEs of macOS →
CVE-2026-86925
An authorization issue was addressed with improved state management
5.5
Medium
CVE-2026-84627
A buffer overflow was addressed with improved bounds checking
7.8
High
CVE-2026-113945
An out-of-bounds read was addressed with improved bounds checking
5.5
Medium
CVE-2026-65327
A logic issue was addressed with improved checks
8.4
High