CVE-2026-86874

This issue was addressed with improved handling of symlinks. It is fixed in Xcode 27.2 and may allow an app to read arbitrary files.

An authorization issue was addressed with improved state management. It is fixed in Xcode 27.2 and may allow an app to access sensitive user data.

A vulnerability in Xcode 27 allowed an app to break out of its sandbox due to missing library validation on affected binaries. The issue was fixed by enforcing library validation.

An input validation issue in Xcode was addressed with improved input validation. Parsing a maliciously crafted binary may lead to unexpected app termination.

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption.

A buffer overflow was addressed with improved bounds checking in Xcode 26.1. The vulnerability could allow a user in a privileged network position to cause a denial-of-service.

A path handling issue was addressed with improved validation. The vulnerability exists in Xcode 26 and involves processing an overly large path value that may crash a process.