CVE-2026-28815: 
Swift vulnerability analysis and mitigation

CVE-2026-28815 is an out-of-bounds read vulnerability in Apple's swift-crypto library affecting the X-Wing HPKE (Hybrid Public Key Encryption) decapsulation path. A remote, unauthenticated attacker can supply a malformed (undersized) X-Wing HPKE encapsulated key to trigger an out-of-bounds read in the underlying C decapsulation code, potentially causing a service crash or memory disclosure. The vulnerability affects swift-crypto versions 4.0.0 through 4.3.0 and was disclosed on April 1–3, 2026, with a fix released in version 4.3.1. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause (CWE-125: Out-of-bounds Read) lies in the X-Wing decapsulation path failing to validate the length of the attacker-controlled encapsulated ciphertext before forwarding it across an FFI boundary into a C API. The C function (XWING_decap) expects a compile-time fixed-size buffer of exactly 1,120 bytes; when a shorter Data value is passed, the C code may read beyond the Swift buffer, constituting undefined behavior. The vulnerable code path is reachable through the initialization of HPKE.Recipient, which calls skR.decapsulate(enc) during construction without enforcing the required length. A proof-of-concept published in the advisory demonstrates the issue by passing a single-byte Data([0x00]) as the encapsulated key, triggering a dynamic-stack-buffer-overflow confirmed via AddressSanitizer (GitHub Advisory).

Successful exploitation can result in a denial of service (application crash) or, depending on runtime memory protections, partial disclosure of process memory contents. Because the vulnerability is reachable without authentication over the network, any service that accepts attacker-supplied HPKE encapsulated keys and uses swift-crypto 4.0.0–4.3.0 is at risk. The CVSS availability impact is rated High, while confidentiality impact is rated None in the base score, though memory disclosure remains a theoretical risk in environments without full memory-safety mitigations (GitHub Advisory, Red Hat CVE).

A complete, runnable XCTest proof-of-concept is publicly available in the Apple security advisory, demonstrating the crash with AddressSanitizer output. The EPSS score is 0.017% (very low), and there is no evidence of in-the-wild exploitation or inclusion in the CISA KEV catalog as of the time of reporting. The vulnerability was discovered and responsibly reported by Cantina, and no threat actor attribution has been identified (GitHub Advisory, Red Hat CVE).

1. Identify target: Locate a network-accessible service built with swift-crypto versions 4.0.0–4.3.0 that accepts X-Wing HPKE encapsulated keys as input (e.g., a TLS or messaging service using the XWingMLKEM768X25519_SHA256_AES_GCM_256 ciphersuite).
2. Craft malformed payload: Prepare an encapsulated key Data value that is shorter than the required 1,120 bytes — as little as a single byte (e.g., Data([0x00])) is sufficient to trigger the vulnerability.
3. Trigger decapsulation: Send the malformed encapsulated key to the target service in a context where it will be passed to HPKE.Recipient(privateKey:ciphersuite:info:encapsulatedKey:), initiating the decapsulation call chain.
4. Achieve impact: The C XWING_decap function reads beyond the undersized Swift buffer, triggering undefined behavior — resulting in a crash (denial of service) or, in the absence of memory-safety mitigations, potential out-of-bounds memory disclosure (GitHub Advisory).

• Logs: Unexpected application crashes or panics in services using swift-crypto, particularly stack traces referencing XWING_decap, HPKE.Recipient, or XWingMLKEM768X25519; AddressSanitizer reports of dynamic-stack-buffer-overflow in swift-crypto processes.
• Network: Inbound requests containing abnormally short (< 1,120 bytes) HPKE encapsulated key fields targeting endpoints that perform X-Wing decapsulation.
• Process: Repeated service restarts or crash reports from processes linked against swift-crypto 4.0.0–4.3.0 without an apparent cause (GitHub Advisory).

Apple has released swift-crypto version 4.3.1, which addresses the vulnerability by adding proper input validation to enforce the required 1,120-byte encapsulated key length before the FFI call into C. All applications and services using swift-crypto versions 4.0.0 through 4.3.0 should upgrade to 4.3.1 or later immediately, as the vulnerability is remotely exploitable without authentication and a public PoC exists. No configuration-based workaround is available; upgrading is the only remediation (GitHub Advisory).

Apple's swift-crypto maintainer (Lukasa) published the advisory on April 1, 2026, crediting Cantina for the detailed vulnerability report. The Swift community was notified via the Swift Forums with a dedicated security release announcement. Red Hat also tracked the CVE, indicating broader ecosystem awareness beyond Apple platforms (Swift Forums, Red Hat CVE).