CVE-2025-43370
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A path handling issue was addressed with improved validation. The vulnerability exists in Xcode 26 and involves processing an overly large path value that may crash a process.
Risk Assessment
An attacker could supply a specially crafted path, causing an application or process crash. This may lead to denial of service.
Recommendation
Update Xcode to version 26 or later, which includes the fix. Avoid processing untrusted input related to paths.
Other vulnerabilities in Xcode
See all- CVE-2026-112605Low risk· EPSS 3%
This issue was addressed with improved handling of symlinks. It is fixed in Xcode 27.2 and may allow an app to read arbitrary files.
- CVE-2026-112602Low risk· EPSS 3%
An authorization issue was addressed with improved state management. It is fixed in Xcode 27.2 and may allow an app to access sensitive user data.
- CVE-2026-86948High
A vulnerability in Xcode 27 allowed an app to break out of its sandbox due to missing library validation on affected binaries. The issue was fixed by enforcing library validation.
- CVE-2026-86875Medium
An input validation issue in Xcode was addressed with improved input validation. Parsing a maliciously crafted binary may lead to unexpected app termination.
- CVE-2026-86874Low
An out-of-bounds read in Xcode was addressed with improved input validation. Parsing a maliciously crafted binary may lead to unexpected tool termination.
- CVE-2025-43505High
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption.
- CVE-2025-43504Medium
A buffer overflow was addressed with improved bounds checking in Xcode 26.1. The vulnerability could allow a user in a privileged network position to cause a denial-of-service.
Original NVD description (English source)
A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS