Is CVE-2026-111923 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111923?

CVE-2026-111923 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2026-111923

Description

Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.