A path handling issue in Apple Xcode was addressed with improved validation. An overly large path value may cause the Xcode process to crash, resulting in a denial of service. The weakness involves improper bounds checking on input strings, which is identified as CWE-120.

The vulnerability affects Apple Xcode, with the issue fixed starting in Xcode 26. No specific release versions are listed as vulnerable, and the description does not provide additional version constraints. Systems running older Xcode versions may be susceptible.

CVSS score of 4 indicates medium severity. The EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild, and the CVE is not catalogued in CISA KEV. The attack vector appears to require local execution or manipulation of Xcode input files, so an attacker would need access to the user environment or the ability to submit large path values through Xcode interfaces.