Apple Swift-Crypto vulnerabilities

2 CVEs affecting Apple Swift-Crypto, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-43823, published 2026-07-23.

More from Apple.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-28815, published 2026-04-03. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentially causing a crash or memory disclosure depending on runtime…
• CVE-2026-43823, published 2026-07-23. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory…