Double-free when parsing RSA public key fails
CriticalCVE-2026-43823 · Published Jul 16, 2026 · updated Aug 10, 2026
### Summary When initializing an RSA public key from DER or PEM bytes throws an error, the `EVP_PKEY*` is double-freed: first in the catch block, then in the `deinit`. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. ### PoC The following tests will reliably trigger an error when run with address sanitizer enabled: ```swift func test_invalidDERPublicKeyThrowsWithoutDoubleFree() throws { // SEQUENCE { INTEGER 0, INTEGER 0 } let badBase64 = "MAYCAQACAQ==" let badDER = Array(Data(base64Encoded: badBase64)!) XCTAssertThrowsError(try _RSA.Signing.PublicKey(derRepresentation: badDER)) } func test_invalidPEMPublicKeyThrowsWithoutDoubleFree() throws { // SEQUENCE { INTEGER 0, INTEGER 0 } let badPEM = """ -----BEGIN PUBLIC KEY----- MAYCAQACAQ== -----END PUBLIC KEY----- """ XCTAssertThrowsError(try _RSA.Signing.PublicKey(pemRepresentation: badPEM)) } ``` ### Impact Uses of `_RSA.Encryption.PublicKey`, `_RSA.Signing.PublicKey`, and `_RSA.BlindSigning.PublicKey` are af...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| swift-crypto Product | >= 3.2.0, < 4.5.1 | 4.5.1 |
Details and references
### Summary When initializing an RSA public key from DER or PEM bytes throws an error, the `EVP_PKEY*` is double-freed: first in the catch block, then in the `deinit`. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. ### PoC The following tests will reliably trigger an error when run with address sanitizer enabled: ```swift func test_invalidDERPublicKeyThrowsWithoutDoubleFree() throws { // SEQUENCE { INTEGER 0, INTEGER 0 } let badBase64 = "MAYCAQACAQ==" let badDER = Array(Data(base64Encoded: badBase64)!) XCTAssertThrowsError(try _RSA.Signing.PublicKey(derRepresentation: badDER)) } func test_invalidPEMPublicKeyThrowsWithoutDoubleFree() throws { // SEQUENCE { INTEGER 0, INTEGER 0 } let badPEM = """ -----BEGIN PUBLIC KEY----- MAYCAQACAQ== -----END PUBLIC KEY----- """ XCTAssertThrowsError(try _RSA.Signing.PublicKey(pemRepresentation: badPEM)) } ``` ### Impact Uses of `_RSA.Encryption.PublicKey`, `_RSA.Signing.PublicKey`, and `_RSA.BlindSigning.PublicKey` are affected. Calling these types initializers with a malformed key will trigger a double-free. Applications that parse untrusted RSA keys using these APIs are affected. ### Credits We would like to acknowledge Sujal Tuladhar for their assistance.
- Severity from
- GitHub (reviewed advisory)
More Apple advisories
All Apple| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 23 | Missing CR/LF/NUL validation in header values | Medium | 1.45.0 |
| Jul 17 | Unauthenticated out-of-bounds stack write via oversized ECDSA signature in swift-nio-ssh | Critical | 0.14.1 |
| Jul 15 | Accessing bytes of non-string SAN can lead to out-of-bounds memory read | Critical | 2.37.2 |
| Jul 9 | Apple FileMaker Server: code execution | Medium4.9 | 26.0.1 |
| Jul 9 | DoS via WebSocket frame with oversize 64-bit payload length field (Int trap in WebSocketFrameDecoder) | High7.5 | 2.101.0 |
| Jul 8 | Packages can be read/written outside the configured cache directory | Medium | 0.32.0 |