CVE-2026-112602
Low risk· EPSS 3%Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
An authorization issue was addressed with improved state management. It is fixed in Xcode 27.2 and may allow an app to access sensitive user data.
Risk Assessment
Unauthorized access to sensitive user data can lead to a breach of information confidentiality.
Recommendation
Update Xcode to version 27.2 or later.
Other vulnerabilities in Xcode
See all- CVE-2026-112605Low risk· EPSS 3%
This issue was addressed with improved handling of symlinks. It is fixed in Xcode 27.2 and may allow an app to read arbitrary files.
- CVE-2026-86948High
A vulnerability in Xcode 27 allowed an app to break out of its sandbox due to missing library validation on affected binaries. The issue was fixed by enforcing library validation.
- CVE-2026-86875Medium
An input validation issue in Xcode was addressed with improved input validation. Parsing a maliciously crafted binary may lead to unexpected app termination.
- CVE-2026-86874Low
An out-of-bounds read in Xcode was addressed with improved input validation. Parsing a maliciously crafted binary may lead to unexpected tool termination.
- CVE-2025-43505High
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption.
- CVE-2025-43504Medium
A buffer overflow was addressed with improved bounds checking in Xcode 26.1. The vulnerability could allow a user in a privileged network position to cause a denial-of-service.
- CVE-2025-43370Medium
A path handling issue was addressed with improved validation. The vulnerability exists in Xcode 26 and involves processing an overly large path value that may crash a process.
Original NVD description (English source)
An authorization issue was addressed with improved state management. This issue is fixed in Xcode 27.2. An app may be able to access sensitive user data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS