EUVD-2026-48287Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Local attack vector as certificate must be presented locally; no privileges needed; high impact on confidentiality and availability.
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
5DescriptionCVE.org
NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an ASN1_STRING, but not all SANs are backed by ASN1_STRING, so accessing the buffer for such a type can lead to out-of-bounds memory access. This vulnerability is addressed in swift-nio-ssl version 2.37.2.
AnalysisAI
Out-of-bounds memory access in Apple swift-nio-ssl allows information disclosure and denial of service when parsing X.509 certificates with non-ASN1_STRING Subject Alternative Names. The vulnerability affects versions prior to 2.37.2 and can be triggered locally by a crafted certificate, leading to potential data leakage or process crash. Public proof-of-concept code exists, but no active exploitation has been reported at this time.
Technical ContextAI
Swift-nio-ssl is a Swift TLS library built on NIOSSL for secure networking. The flaw lies in NIOSSLCertificate._subjectAlternativeNames, which exposes raw byte buffers for certificate SAN extensions. The code assumes all SANs are backed by ASN1_STRING (OpenSSL's string type), but some SAN types (e.g., iPAddress, dirName) use different backing storage. Accessing the buffer of a non-ASN1_STRING SAN results in an out-of-bounds read (CWE-125), potentially exposing adjacent memory or causing a segmentation fault. CPE data confirms the vulnerable component is apple:swift-nio-ssl, and the issue arises during TLS handshake when certificate SANs are inspected.
RemediationAI
Upgrade to swift-nio-ssl version 2.37.2 or later, as provided by Apple. If immediate patching is not possible, limit certificate processing to trusted Certificate Authorities and avoid inspecting raw SAN bytes from untrusted sources. As a temporary workaround, disable certificate SAN introspection in custom TLS handlers and rely on default chain validation, though this may weaken hostname verification. The latest release can be obtained via the Swift Package Manager referencing the fixed tag.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today