An application executed within Xcode can overwrite arbitrary files because the IDE does not enforce proper state boundaries, a flaw categorized as CWE‑787. This allows an attacker to replace any file accessible to the Xcode process, potentially corrupting system or application configuration and undermining integrity.

Apple Xcode, versions prior to 16.3 are vulnerable; Xcode 16.3 and later contain the state‑management fix.

The CVSS score of 5.5 indicates a moderate severity, while the EPSS score of less than 1% shows a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require the attacker to run code inside an Xcode session, implying that the threat vector is primarily local, though a compromised developer machine could be leveraged.