SEPTEMBER 20, 2026
Live Feed
Back to database
Case File

CVE-2026-43823

HIGH · CVSS 7.5 EPSS 0.26% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-23 · Last synced 2026-08-22

CyberRota Analysis

AI-Generated

A double-free vulnerability exists in the handling of RSA public keys when BoringSSL fails to decode DER or PEM formatted bytes, potentially leading to application crashes during subsequent memory allocations. This issue affects unspecified products utilizing BoringSSL and should be prioritized by developers and organizations using swift-crypto versions prior to 4.5.1 to mitigate the risk of instability in their applications.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-43823
Severity
HIGH
CVSS
7.5
EPSS
0.26%

Original NVD Description

When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. This vulnerability is addressed in swift-crypto version 4.5.1.