apple Xcode vulnerabilities

Latest apple Xcode CVEs

Newest publication first · page 1 of 5

1. CVE-2026-112605 This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files.

   Published 2026-10-30

   Low·CVSS 3.3

   This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files.

2. CVE-2026-112602 An authorization issue was addressed with improved state management. This issue is fixed in Xcode 27.2. An app may be able to access sensitive user data.

   Published 2026-10-30

   Low·CVSS 3.3

   An authorization issue was addressed with improved state management. This issue is fixed in Xcode 27.2. An app may be able to access sensitive user data.

3. CVE-2026-86949 This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.

   Published 2026-10-20

   High·CVSS 8.8 EPSS 0.16%

   This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.

4. CVE-2026-86948 This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox.

   Published 2026-10-20

   High·CVSS 7.8 EPSS 0.14%

   This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox.

5. CVE-2026-86875 An input validation issue was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected app termination.

   Published 2026-10-20

   Medium·CVSS 4.3 EPSS 0.28%

   An input validation issue was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected app termination.

6. CVE-2026-86874 An out-of-bounds read was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected tool termination.

   Published 2026-10-20

   Low·CVSS 3.3 EPSS 0.16%

   An out-of-bounds read was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected tool termination.

7. CVE-2026-65393 A permissions issue was addressed with improved validation. This issue is fixed in Xcode 27, macOS Golden Gate 27. An app may be able to access user-sensitive data.

   Published 2026-09-14

   Medium·CVSS 5.5

   A permissions issue was addressed with improved validation. This issue is fixed in Xcode 27, macOS Golden Gate 27. An app may be able to access user-sensitive data.

8. CVE-2026-28890 An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 26.4. An app may be able to cause unexpected system termination.

   Published 2026-03-25

   Medium·CVSS 5.5

   An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 26.4. An app may be able to cause unexpected system termination.

9. CVE-2026-28889 A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 26.4. An app may be able to read arbitrary files as root.

   Published 2026-03-25

   Medium·CVSS 6.2

   A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 26.4. An app may be able to read arbitrary files as root.

10. CVE-2025-31186 A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences.

    Published 2026-01-16

    Low·CVSS 3.3

    A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences.

11. CVE-2025-43504 A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position may be able to cause a denial-of-service.

    Published 2025-11-04

    Medium·CVSS 4.9

    A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position may be able to cause a denial-of-service.

12. CVE-2025-43505 An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption.

    Published 2025-11-04

    High·CVSS 8.8

    An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption.

13. CVE-2025-43375 The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.

    Published 2025-09-15

    Medium·CVSS 5.5

    The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.

14. CVE-2025-43263 The issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to read and write files outside of its sandbox.

    Published 2025-09-15

    High·CVSS 7.1

    The issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to read and write files outside of its sandbox.

15. CVE-2025-43371 This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox.

    Published 2025-09-15

    High·CVSS 8.2

    This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox.

16. CVE-2025-43370 A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.

    Published 2025-09-15

    Medium·CVSS 4.0

    A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.

17. CVE-2025-48384 Git allows arbitrary code execution through broken config quoting

    Published 2025-07-08

    High·CVSS 8.1 EPSS 4.4% CISA KEV added 2025-08-25 Exploited in the wild

    Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config...

18. CVE-2025-30441 This issue was addressed through improved state management. This issue is fixed in Xcode 16.3. An app may be able to overwrite arbitrary files.

    Published 2025-03-31

    Medium·CVSS 5.5

    This issue was addressed through improved state management. This issue is fixed in Xcode 16.3. An app may be able to overwrite arbitrary files.

19. CVE-2025-24226 The issue was addressed with improved checks. This issue is fixed in Xcode 16.3. A malicious app may be able to access private information.

    Published 2025-03-31

    Medium·CVSS 5.5

    The issue was addressed with improved checks. This issue is fixed in Xcode 16.3. A malicious app may be able to access private information.

20. CVE-2024-44228 This issue was addressed with improved permissions checking. This issue is fixed in Xcode 16. An app may be able to inherit Xcode permissions and access user data.

    Published 2024-10-28

    High·CVSS 7.5

    This issue was addressed with improved permissions checking. This issue is fixed in Xcode 16. An app may be able to inherit Xcode permissions and access user data.

21. CVE-2024-44191 This issue was addressed through improved state management. This issue is fixed in Xcode 16, iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. An app m...

    Published 2024-09-16

    Medium·CVSS 5.5

    This issue was addressed through improved state management. This issue is fixed in Xcode 16, iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. An app may gain unauthorized access to Bluetooth.

22. CVE-2024-40862 A privacy issue was addressed by removing sensitive data. This issue is fixed in Xcode 16. An attacker may be able to determine the Apple ID of the owner of the computer.

    Published 2024-09-16

    Medium·CVSS 5.3

    A privacy issue was addressed by removing sensitive data. This issue is fixed in Xcode 16. An attacker may be able to determine the Apple ID of the owner of the computer.

23. CVE-2024-44162 This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user's Keychain items.

    Published 2024-09-16

    High·CVSS 7.8

    This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user's Keychain items.

24. CVE-2024-23298 A logic issue was addressed with improved state management. This issue is fixed in Xcode 15.3. An app may bypass Gatekeeper checks.

    Published 2024-03-15

    Medium·CVSS 5.5

    A logic issue was addressed with improved state management. This issue is fixed in Xcode 15.3. An app may bypass Gatekeeper checks.

25. CVE-2023-40435 This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 15. An app may be able to access App Store credentials.

    Published 2023-09-26

    Medium·CVSS 5.5

    This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 15. An app may be able to access App Store credentials.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.