EUVD-2026-280122

fkie_cve-2026-28815

A remote attacker can supply a short X-Wing HPKE encapsulated key and trigger an out-of-bounds read in the C decapsulation path, potentially causing a crash or memory disclosure depending on runtime protections. This issue is fixed in swift-crypto version 4.3.1.

GHSA-9m44-rr2w-ppp7 — Swift Crypto: X-Wing HPKE Decapsulation Accepts Malformed Ciphertext Length

Affected: SwiftURL: swift-crypto

### Summary

The X-Wing decapsulation path accepts attacker-controlled encapsulated ciphertext bytes without enforcing the required fixed ciphertext length. The decapsulation call is forwarded into a C API, which expects a compile-time fixed-size ciphertext buffer of 1120 bytes. This creates an FFI memory-safety boundary issue when a shorter `Data` value is passed in, because the C code may read beyond the Swift buffer.

The issue is reachable through initialization of an `HPKE.Recipient`, which decapsulates the provided `encapsulatedKey` during construction. A malformed `encapsulatedKey` can therefore trigger undefined behavior instead of a safe length-validation error.

### Details

The `decapsulate` function of `OpenSSLXWingPrivateKeyImpl` does not perform a length check before passing the `encapsulated` data to the C API.

```swift func decapsulate(_ encapsulated: Data) throws -> SymmetricKey { try SymmetricKey(unsafeUninitializedCapacity: Int(XWING_SHARED_SECRET_BYTES)) { sharedSecretBytes, count in try encapsulated.withUnsafeBytes { encapsulatedSecretBytes in let rc = CCryptoBoringSSL_XWING_decap( sharedSecretBytes.baseAddress, encapsulatedSecretBytes.baseAddress, &self.privateKey ) guard rc == 1 else { throw CryptoKitError.internalBoringSSLError() } count = Int(XWING_SHARED_SECRET_BYTES) } } } ```

The C API does not have…

Most recent entries from all

EUVD-2026-280122

fkie_cve-2026-28815

GHSA-9m44-rr2w-ppp7 — Swift Crypto: X-Wing HPKE Decapsulation Accepts Malformed Ciphertext Length