CVE-2026-86875
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
An input validation issue in Xcode was addressed with improved input validation. Parsing a maliciously crafted binary may lead to unexpected app termination.
Risk Assessment
A malicious binary can crash the tool, potentially disrupting build or analysis workflows.
Recommendation
Update Xcode to version 27 containing the fix.
Other vulnerabilities in Xcode
See all- CVE-2026-112605Low risk· EPSS 3%
This issue was addressed with improved handling of symlinks. It is fixed in Xcode 27.2 and may allow an app to read arbitrary files.
- CVE-2026-112602Low risk· EPSS 3%
An authorization issue was addressed with improved state management. It is fixed in Xcode 27.2 and may allow an app to access sensitive user data.
- CVE-2026-86948High
A vulnerability in Xcode 27 allowed an app to break out of its sandbox due to missing library validation on affected binaries. The issue was fixed by enforcing library validation.
- CVE-2026-86874Low
An out-of-bounds read in Xcode was addressed with improved input validation. Parsing a maliciously crafted binary may lead to unexpected tool termination.
- CVE-2025-43505High
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption.
- CVE-2025-43504Medium
A buffer overflow was addressed with improved bounds checking in Xcode 26.1. The vulnerability could allow a user in a privileged network position to cause a denial-of-service.
- CVE-2025-43370Medium
A path handling issue was addressed with improved validation. The vulnerability exists in Xcode 26 and involves processing an overly large path value that may crash a process.
Original NVD description (English source)
An input validation issue was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected app termination.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS