CVE-2026-111923CWE-674

CVE-2026-111923

High · published October 17, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
28.4
In the wild
Unconfirmed
What it is

Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00359 · 28.4th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-10-17T23:16Z
References (2)
https://github.com/fleetdm/fleet/security/advisories/GHSA-x467-vgxf-2g6h · [email protected]https://www.vulncheck.com/advisories/fleet-before-4.89.0-unauthenticated-dos-via-apple-mdm-enrollment-plist-parsing · [email protected]
EPSS history
Timeline
  • 19 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 17 OCT 18:46Z
    Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing
    cvelistv5
  • 17 OCT 18:46Z
    Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing
    cvelistv5