Vulnerability · Published Oct 17, 2026 · Assigned by VulnCheck
CVE-2026-111923Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing
High 7.5
In plain English
A high-severity security flaw in fleet from fleetdm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 70.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.
Affected products (as reported)
Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-x467-vgxf-2g6h) vendor-advisory
- VulnCheck Advisory: Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing third-party-advisory