{"id":"CVE-2026-86983","title":"A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length","summary":"A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3.","severity":"none","vendor":"Apple","product":"swift-crypto","affected":["swift-crypto < 5.0.3"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T23:02:44.171Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-86983","references":[{"url":"https://github.com/apple/swift-crypto/security/advisories/GHSA-jwv7-rv4f-rff2"}],"tags":["cve.org"],"epss":0.00162,"epssPercentile":0.05442,"ingestedAt":"2026-10-30T21:09:21.620Z","slug":"CVE-2026-86983","body":"## Overview\n\nA remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3.\n\n## Affected\n\n- `swift-crypto < 5.0.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}