Read the docs
TI-2026-82252 Aliases CVE-2026-86983

Swift-crypto P-384 VOPRF input length check can terminate process

Priority LOW 26CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

Apple swift-crypto before 5.0.3 is affected. Improper input validation lets the P-384 VOPRF API accept input of any length, which can terminate the process that passes such input to it. A remote attacker without privileges or user interaction can trigger this, although the attack has high complexity and affects availability only.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00275 20th percentileScored 2026-11-07
Fix Fixed swift-crypto (Apple): 5.0.3Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Appleswift-cryptobefore 5.0.35.0.3Patch availableCNA
  • swift-crypto VendorApple Affected before 5.0.3 Fixed in 5.0.3 Patch available CNA

Remediation

Upgrade swift-crypto to version 5.0.3, which fixes the issue. Red Hat fixes Red Hat Hardened Images in RHSA-2026:93977, released 2026-11-02.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA swift-crypto (Apple) Fixed in 5.0.3

Red Hat 1 advisory

  • RHSA-2026:93977 Released 2026-11-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images swift-lang-6.4.2-0.2.hum1@aarch64, swift-lang-6.4.2-0.2.hum1@src, swift-lang-6.4.2-0.2.hum1@x86_64 +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesFixed RHSA-2026:93977

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-86983
  2. 2026-10-29 Affected versions changed · Red Hat
  3. 2026-10-29 CVSS score added · Red Hat
  4. 2026-11-03 Fix available: RHSA-2026:93977 · Red Hat
  5. 2026-11-03 Fix available: Red Hat Hardened Images · Red Hat
  6. 2026-11-04 CVSS score added · CISA ADP
  7. 2026-11-04 Weakness changed · CISA ADP
  8. 2026-11-04 CISA SSVC decision points changed

References

Other 1

  • TI-2026-46583 Improper authentication in Apple macOS KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-28008 Out-of-bounds write in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-22441 Apple iOS and iPadOS: An attacker with arbitrary read and write capability may be able to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-22440 Memory corruption in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-17951 Out-of-bounds write in Apple Safari KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-17847 Use after free in Apple iOS and iPadOS KEVCVSS 3.1CRITICAL 10.0
See all 9536 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences