CVE-2026-28815
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentially causing a crash or memory disclosure depending on runtime protections. This issue is fixed in swift-crypto version 4.3.1.
Risk Assessment
The risk includes potential disclosure of sensitive data in memory or application crash, leading to confidentiality and availability breaches.
Recommendation
Upgrade the swift-crypto library to version 4.3.1 or later.
Other vulnerabilities in swift-crypto
Original NVD description (English source)
A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentially causing a crash or memory disclosure depending on runtime protections. This issue is fixed in swift-crypto version 4.3.1.