CVE-2026-43823 is a double-free vulnerability in swift-crypto's RSA public key initialization process. When decoding DER or PEM formatted RSA public keys, if BoringSSL fails to decode the key, a double-free can occur, corrupting memory and causing a denial of service via system crash. This vulnerability affects the swift-lang RPM packages included in Red Hat Hardened Images. The issue is classified under CWE-763 (Release of Invalid Pointer or Reference) and related CWEs. Red Hat has issued an advisory (RHSA-2026:45785) describing the vulnerability and listing updated swift-lang packages (version 6.3.3-0.1.1.hum1) that address this issue. However, the advisory does not explicitly confirm the availability of a patch or fix status.

The vulnerability can lead to memory corruption and a denial of service condition due to a system crash when an RSA public key fails to decode properly. There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported. The impact is limited to denial of service.

Patch status is not yet confirmed — check the Red Hat advisory (RHSA-2026:45785) and https://images.redhat.com/ for current remediation guidance. Until a fix is confirmed and applied, users should monitor Red Hat communications for updates. No vendor advisory states that no action is required or that the issue is already mitigated.