A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentially causing a crash or …

A remote attacker can exploit a vulnerability in swift-crypto by supplying a short X-Wing HPKE encapsulated key, triggering an out-of-bounds read in the C decapsulation path. This can potentially cause application crashes or memory disclosure depending on runtime protections. The vulnerability affects the cryptographic library's key decapsulation functionality. Apple has addressed this issue in swift-crypto version 4.3.1. The vulnerability allows remote exploitation without authentication. Organizations using affected versions should upgrade immediately to prevent potential memory disclosure attacks.