CVE-2026-113957 An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pul
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-113957?
CVE-2026-113957 is a vulnerability in Apple container, published on 29 Oct 2026.
Official description
An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a mismatch. Tag pulls are exempt, because a tag is mutable by design. The fix also verifies the hash of manifests and blobs when they are fetched. This vulnerability is addressed in container version 1.6.0 and containerization version 0.52.1.
Which versions are affected by CVE-2026-113957?
How do I fix CVE-2026-113957?
No fix has been published for CVE-2026-113957 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-113957 being exploited?
There is no known exploitation of CVE-2026-113957 in the wild and no public exploit code.