CVE-2026-43823: When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. in Apple swift-crypto
CVE-2026-43823 is a vulnerability in Apple swift-crypto where initializing an RSA public key from DER or PEM bytes can cause a double-free of the EVP_PKEY* object if an error occurs during decoding. This double-free happens first in the catch block and then again during object deinitialization, potentially leading to crashes on subsequent memory allocations. The issue arises when BoringSSL fails to decode the provided public key bytes. This vulnerability is fixed in swift-crypto version 4.5.1.
AI Analysis
Technical Summary
The vulnerability occurs in Apple swift-crypto when an RSA public key initialization from DER or PEM encoded bytes fails. Specifically, if BoringSSL cannot decode the public key bytes, the EVP_PKEY* pointer is freed twice: once in the error handling catch block and again during the deinitialization of the object. This double-free can cause crashes in future memory allocations, potentially destabilizing applications using the affected library. The issue is resolved in swift-crypto version 4.5.1.
Potential Impact
The double-free vulnerability can lead to application crashes due to memory corruption when the EVP_PKEY* is freed twice. This may cause denial of service conditions in applications relying on swift-crypto for RSA public key handling. There is no indication of code execution or data leakage from the provided information.
Mitigation Recommendations
Upgrade to swift-crypto version 4.5.1 or later, where this double-free issue has been addressed. No other mitigation steps are indicated or required.
CVE-2026-43823: When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. in Apple swift-crypto
Description
CVE-2026-43823 is a vulnerability in Apple swift-crypto where initializing an RSA public key from DER or PEM bytes can cause a double-free of the EVP_PKEY* object if an error occurs during decoding. This double-free happens first in the catch block and then again during object deinitialization, potentially leading to crashes on subsequent memory allocations. The issue arises when BoringSSL fails to decode the provided public key bytes. This vulnerability is fixed in swift-crypto version 4.5.1.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability occurs in Apple swift-crypto when an RSA public key initialization from DER or PEM encoded bytes fails. Specifically, if BoringSSL cannot decode the public key bytes, the EVP_PKEY* pointer is freed twice: once in the error handling catch block and again during the deinitialization of the object. This double-free can cause crashes in future memory allocations, potentially destabilizing applications using the affected library. The issue is resolved in swift-crypto version 4.5.1.
Potential Impact
The double-free vulnerability can lead to application crashes due to memory corruption when the EVP_PKEY* is freed twice. This may cause denial of service conditions in applications relying on swift-crypto for RSA public key handling. There is no indication of code execution or data leakage from the provided information.
Mitigation Recommendations
Upgrade to swift-crypto version 4.5.1 or later, where this double-free issue has been addressed. No other mitigation steps are indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apple
- Date Reserved
- 2026-05-01T22:46:27.822Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a622e759c2644c7f84289a7
Added to database: 07/23/2026, 15:08:37 UTC
Last enriched: 07/23/2026, 15:22:12 UTC
Last updated: 07/23/2026, 16:08:20 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.