CVE-2026-86949
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
This issue was addressed by enforcing library validation on the affected binaries. The flaw affects Xcode 27. A malicious app may be able to break out of its sandbox.
Risk Assessment
A malicious app could escape sandbox restrictions and access resources outside its environment, increasing the risk of further exploitation.
Recommendation
Update Xcode to version 27. Restrict installation of untrusted apps.
Other vulnerabilities in Apple Xcode
See all- CVE-2016-4705High
otool in Apple Xcode before version 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors.
- CVE-2016-4704High
otool in Apple Xcode before version 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors.
- CVE-2016-1765High
otool in Apple Xcode before version 7.3 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors.
- CVE-2015-7030High
The Swift implementation in Apple Xcode before version 7.1 mishandles type conversion, which can lead to unspecified impacts and attack vectors.
- CVE-2015-1149High
Integer overflow in the Swift simulator in Apple Xcode before version 6.3 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact by triggering an incorrect result of a type conversion.
Original NVD description (English source)
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS