This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox.
CVE-2026-86948
CVSS base score
8.8 (v3.1)
Severity
HIGH
Attack vector
Local
Weakness
CWE-829, CWE-284, CWE-693
Last modified
October 30, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
apple xcode
References
- support.apple.com Release Notes, Vendor Advisory