CVE-2026-111923 is a high severity (CVSS 7.5) unbounded recursion flaw in Fleet before 4.89.0. An unauthenticated caller can crash the server by sending a small crafted binary plist to Apple MDM enrollment endpoints. Upgrade to 4.89.0 or later. The sections below cover affected versions, how to check, and what to do first.
What's affected
Fleet before 4.89.0, per the record, VulnCheck and the GitHub advisory, which lists 4.89.0 as the patched version. The advisory covers the Go module github.com/fleetdm/fleet.
Only servers with Apple MDM enabled are exposed. The advisory says the impact is availability only, with no data exposure, no authentication bypass and no privilege escalation.
Scoring note: the record's 7.5 is a CVSS 3.1 base score. VulnCheck's advisory also lists 8.7 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Check your Fleet server version in the web interface or from the image tag you deploy. Confirm whether Apple MDM is enabled in your configuration.
If it is, check that the enrollment endpoints are the only ones you expose to devices. Watch for server restarts and out of memory events in your orchestrator, which would match the crash behaviour.
What to do now
- Find your Fleet server version and whether Apple MDM is on.
- Upgrade to 4.89.0 or later.
- Run Fleet under a supervisor so it restarts after a crash.
- Set memory limits and alerts on the server process.
- Limit exposure of the enrollment endpoints to what devices need.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Prioritise by what is reachable, not by the score alone. Reachability analysis asks whether your own code actually calls the vulnerable path and whether an attacker can get to it. A flaw in a component you never expose is less urgent than the same flaw on a public host, so use that view to order your work.
Why it matters
This is CWE-674, uncontrolled recursion. A binary property list can contain references from one object to another. The parser followed them with no depth or cycle limit, so a tiny payload of about 150 bytes could force exponential allocation or endless recursion.
The payload is parsed before the device is authenticated, which is why no credentials are needed. Parsers of untrusted formats need depth limits and cycle detection by default. It is not listed in CISA KEV.
Quick check
Does this expose device data?
No. The advisory says availability only.
Which version fixes it?
4.89.0, according to the GitHub advisory.
Sources
Last reviewed: 18 October 2026.
