High priorityDisclosed

Advisory · CVE-2026-111923

Crafted MDM enrollment plist can crash Fleet through unbounded recursion

Fleet before 4.89.0 contains an unbounded recursion flaw in Apple MDM enrollment property list parsing, so an unauthenticated attacker can crash the server with a crafted binary plist payload of about 150 bytes. CVSS 4.0 8.7 (CVSS 3.1 7.5).

Advisory published October 17, 2026Independent summary
Vendor
fleetdm
Product
Fleet
Identifier / CWE
CVE-2026-111923
CWE-674
Action timing
Immediate
ELI5

Explain it like I’m five

A tiny enrollment file can be nested like a trap of boxes inside boxes, and Fleet keeps opening them until it runs out of memory and falls over.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Crafted plist sent

    An unauthenticated attacker sends a crafted binary plist payload of about 150 bytes to the MDM enrollment endpoints.

  2. 02Parser recurses

    Fleet property list parsing follows the nesting without a bound, triggering exponential allocation or infinite recursion.

  3. 03Server crashes

    CPU and memory are exhausted and the Fleet server crashes.

What happened

Fleet disclosed CVE-2026-111923 for versions before 4.89.0: an unbounded recursion flaw (CWE-674) in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server with a crafted binary plist payload of about 150 bytes sent to the enrollment endpoints.

Per the vendor affected data in the NVD record, 4.89.0 is the first unaffected release, so upgrading to 4.89.0 or later is the stated fix.

What to do

  1. Inventory Fleet servers, including test and staging instances with enrollment endpoints exposed.
  2. Upgrade affected instances to 4.89.0 or later using the project release guidance.
  3. Restrict access to MDM enrollment endpoints to expected networks while remediation is underway.
  4. Hunt for enrollment requests followed by server restarts, and memory spikes tied to small plist payloads.
  5. Verify the deployed version after updating, not just that an update ran.

Management note

Enrollment endpoints must stay reachable for new devices, which makes an unauthenticated crash bug an availability risk you cannot firewall away. Patch promptly and watch restart counts.