CVE-2026-86949: Input Validation
App Store. This issue was addressed by enforcing library validation on the affected binaries.
Other sources
CoreSymbolication. An input validation issue was addressed with improved input validation.
— Apple
otool. An out-of-bounds read was addressed with improved input validation.
— Apple
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.
— MITRE
Xcode. This issue was addressed by enforcing library validation on the affected binaries.
— Apple
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 27 - Upgrade
Upgrade
Xcodeto a version that resolves this vulnerability.Fixed in 27 - Configuration
Enforce library validation on the affected binaries
Affected binaries Library validation = enforced
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
Who is exposed to this issue?
Systems running an affected version of Apple Xcode are potentially exposed if a malicious app can be run on the system.
What does an attacker need to exploit it?
The available information indicates that an attacker needs a malicious app. Successful exploitation may allow that app to break out of its sandbox.
What is the remediation?
Update to Xcode 27, which fixes the issue by enforcing library validation on the affected binaries.