CVE-2025-43505
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption.
Risk Assessment
Processing a malicious file may cause heap corruption, potentially leading to arbitrary code execution or application crash.
Recommendation
Update Xcode to version 26.1 or later.
Other vulnerabilities in Xcode
See all- CVE-2025-43504Medium
A buffer overflow was addressed with improved bounds checking in Xcode 26.1. The vulnerability could allow a user in a privileged network position to cause a denial-of-service.
- CVE-2025-43370Medium
A path handling issue was addressed with improved validation. The vulnerability exists in Xcode 26 and involves processing an overly large path value that may crash a process.
Original NVD description (English source)
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS