CVE-2026-86874: Input Validation
An out-of-bounds read was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected tool termination.
Other sources
App Store. This issue was addressed by enforcing library validation on the affected binaries.
— Apple
CoreSymbolication. An input validation issue was addressed with improved input validation.
— Apple
otool. An out-of-bounds read was addressed with improved input validation.
— Apple
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 27 - Upgrade
Upgrade
Xcodeto a version that resolves this vulnerability.Fixed in 27 - Configuration
Enforce library validation on the affected binaries.
affected binaries library validation = enforced
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What must an attacker provide to trigger this issue?
The issue is triggered when Xcode parses a maliciously crafted binary.
What is the likely impact of successful exploitation?
Parsing the crafted binary may cause an unexpected tool termination, consistent with a denial-of-service impact.
Which version includes the fix?
Apple fixed the issue in Xcode 27.