CVE-2026-86983: Apple swift-crypto vulnerability

Q: What conditions are required for exploitation?

A remote attacker must be able to supply input that is passed to the P-384 VOPRF API without a length bound. The described impact is termination of the process handling that input.

Q: What remediation is available?

Update swift-crypto to version 5.0.3, which addresses the vulnerability.

Published Oct 28, 2026

Updated

A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3.

Affected Software

1 affected component

Apple swift-crypto<5.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade swift-crypto to a version that resolves this vulnerability.
Fixed in 5.0.3

Event History

Oct 28, 2026

CVE Published

via MITRE·11:01 PM

Data Sourced

via MITRE·11:01 PM

DescriptionWeakness

Frequently Asked Questions

What conditions are required for exploitation?

A remote attacker must be able to supply input that is passed to the P-384 VOPRF API without a length bound. The described impact is termination of the process handling that input.

What remediation is available?

Update swift-crypto to version 5.0.3, which addresses the vulnerability.