Swift-crypto vulnerabilities

2 known vulnerabilities in Swift-crypto from Apple. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  swift-crypto: Double Free

  CVE-2026-43823Jul 23, 2026Apple

  When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot deco

• 7.5 High severity

  macOS: Out-of-bounds Read

  CVE-2026-28815Apr 3, 2026Apple

  A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentially causing a crash or memory disclosure depending on runtime protections. This issue is fixed in swift-crypto version 4.3.