CVE-2026-43823
Awaiting Analysis Awaiting Analysis - Queue

RSA Public Key Parsing Double-Free in Swift-Crypto

Publication date: 2026-07-23

Last updated on: 2026-07-23

Assigner: Apple Inc.

Description
When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. This vulnerability is addressed in swift-crypto version 4.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-23
Last Modified
2026-07-23
Generated
2026-07-23
AI Q&A
2026-07-23
EPSS Evaluated
N/A
NVD
CVE-2026-43823
EUVD
EUVD-2026-48288

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apple swift_crypto 4.5.1
apple swift_crypto From 3.2.0 (inc) to 4.5.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a double-free issue in the Swift Crypto library when parsing invalid RSA public keys in DER or PEM format. When an error occurs during initialization, the EVP_PKEY structure is freed twice, once in the catch block and again during deinitialization. This can cause crashes on subsequent memory allocations.

Detection Guidance

To detect this vulnerability, check if your system uses Swift Crypto versions between 3.2.0 and 4.5.0. Run: swift package show-dependencies --format json | grep swift-crypto. If the version is within the affected range, the system is vulnerable.

Impact Analysis

If you use Swift Crypto versions between 3.2.0 and 4.5.0 to parse untrusted RSA keys, this flaw could crash your application. It may lead to denial-of-service conditions or unexpected behavior when handling malformed public keys.

Mitigation Strategies

Upgrade Swift Crypto to version 4.5.1 or later. For Swift Package Manager projects, update the dependency in Package.swift to .package(url: "https://github.com/apple/swift-crypto.git", from: "4.5.1"). Rebuild and redeploy the application.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-43823. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart