CVE-2026-112605
Low risk· EPSS 3%Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
This issue was addressed with improved handling of symlinks. It is fixed in Xcode 27.2 and may allow an app to read arbitrary files.
Risk Assessment
An app may gain access to files it should not be able to read, risking data exposure.
Recommendation
Update Xcode to version 27.2 or later.
Other vulnerabilities in Xcode
See all- CVE-2026-112602Low risk· EPSS 3%
An authorization issue was addressed with improved state management. It is fixed in Xcode 27.2 and may allow an app to access sensitive user data.
- CVE-2026-86948High
A vulnerability in Xcode 27 allowed an app to break out of its sandbox due to missing library validation on affected binaries. The issue was fixed by enforcing library validation.
- CVE-2026-86875Medium
An input validation issue in Xcode was addressed with improved input validation. Parsing a maliciously crafted binary may lead to unexpected app termination.
- CVE-2026-86874Low
An out-of-bounds read in Xcode was addressed with improved input validation. Parsing a maliciously crafted binary may lead to unexpected tool termination.
- CVE-2025-43505High
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption.
- CVE-2025-43504Medium
A buffer overflow was addressed with improved bounds checking in Xcode 26.1. The vulnerability could allow a user in a privileged network position to cause a denial-of-service.
- CVE-2025-43370Medium
A path handling issue was addressed with improved validation. The vulnerability exists in Xcode 26 and involves processing an overly large path value that may crash a process.
Original NVD description (English source)
This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS