CVE-2026-43671: Apple SwiftNIO out-of-bounds write in ByteBuffer

CVE-2026-43671 · Severity: high · CVSS 8.3 · Published 2026-06-12

SwiftNIO, a high-performance networking framework for Apple platforms, is vulnerable to memory corruption. An attacker who can provide extremely large values (over 4GB) for data lengths or positions could cause the application to write data to the wrong memory location. This could lead to application crashes, data corruption, or potentially allow an attacker to gain further control over the system.

Technologies: Apple SwiftNIO, github.com/apple/swift-nio (Swift). Vendors: Apple, Swift.

Quick answers

Is CVE-2026-43671 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-43671 being exploited in the wild.
How severe is CVE-2026-43671?
High severity, with a CVSS score of 8.3, published 12 June 2026.
Which products and versions are affected?
Apple SwiftNIO >= 1.0.0, <= 2.99.0; github.com/apple/swift-nio (Swift) >= 1.0.0, <= 2.99.0.
Is there a fix for CVE-2026-43671?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-43671 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-43671?
Check whether you run Apple SwiftNIO or github.com/apple/swift-nio (Swift) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in SwiftNIO's ByteBuffer implementation where internal helper functions _toIndex and _toCapacity used UInt32(truncatingIfNeeded:) to convert Int values. On 64-bit platforms, this silently discards the upper 32 bits of values exceeding 4,294,967,295, causing bounds checks to pass incorrectly. Affected methods include copyBytes(at:to:length:) and writeWithUnsafeMutableBytes(minimumWritableBytes:). An attacker who can influence these parameters can trigger out-of-bounds memory writes, potentially corrupting adjacent heap memory in optimized release builds. The issue is fixed in version 2.100.0 by using the standard UInt32(_:) initializer which traps on overflow.

Affected products

  • Apple swift-nio >= 1.0.0, <= 2.99.0

Identifiers

  • CVE-2026-43671
  • GHSA-r3rc-9hpw-54v9

Timeline

  • 2026-05-21: disclosed
  • 2026-06-12: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.