NIOSSLCertificate._subjectAlternativeNames exposes the raw bytes of a certificate’s Subject Alternative Names (SANs). It assumes those bytes are backed by an ASN1_STRING, but some SANs are not. When an unsupported SAN type is encountered, reading its buffer results in an out‑of‑bounds memory read. This buffer over‑read can corrupt memory and potentially leak sensitive data to an attacker.

The vulnerability affects Apple’s Swift NIO SSL library. Versions prior to 2.37.2 are susceptible and 2.37.2 and later releases.

The CVSS score is 7.7, indicating a high severity, while the EPSS score of less than 1% suggests a low probability of exploitation. The issue is not listed in CISA’s KEV catalog. The attack vector is likely indirect; an attacker would need to influence the processing of certificate SANs, which could occur through crafted TLS traffic or by supplying certificates within the affected application. This requirement makes exploitation difficult, but the vulnerability still presents a serious risk if the condition is met.