CVE-2026-28815

Published: Apr 03, 2026 Last Modified: Apr 03, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentially causing a crash or memory disclosure depending on runtime protections. This issue is fixed in swift-crypto version 4.3.1.

https://github.com/apple/swift-crypto/security/advisories/G…
https://github.com/apple/swift-crypto/security/advisories/GHSA-9m44-rr2w-ppp7