CVE-2026-111923 — Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing
Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attack…
Published: 2026-10-17 · CVSS: 8.7 · CVSS 4.0
Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7