–
Not scored
CVE-2026-86983
A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length.
swift-cryptoAffectedswift-crypto
FixUpdate to 5.0.3 or newer
PublishedOct 28, 23:01 · apple
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.
Description
A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3.
From apple
Affected and fixed versions
ProductAffectedFixed inswift-cryptobefore 5.0.35.0.3
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known