CVE-2026-112605: Apple Xcode vulnerability
Published Oct 29, 2026
·Updated
CoreDevice. This issue was addressed with improved handling of symlinks.
Other sources
This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files.
— MITRE
Credit
Vladislav Shevchenko (Positive Technologies), Roel(van Dijk)
Affected Software
1 affected componentFixes available
Apple Xcode<27.2
27.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 27.2 - Upgrade
Upgrade
Xcodeto a version that resolves this vulnerability.Fixed in 27.2
Event History
Oct 29, 2026
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Oct 30, 2026
CVE Published
via MITRE·12:26 AM
Data Sourced
via MITRE·12:26 AM
DescriptionWeakness
Data Sourced
via NVD·01:16 AM
Description
Frequently Asked Questions
1
What is the impact of successful exploitation?
An app may be able to read arbitrary files.
2
Which version contains the fix?
Apple fixed the issue in Xcode 27.2.
3
What component was changed to address the issue?
The issue was addressed in CoreDevice through improved handling of symlinks.