A buffer overflow that allowed a privileged network user to terminate Xcode exists. The flaw was mitigated by enhanced bounds checking and is fixed in Xcode 26.1. The vulnerability falls under CWE‑119, a buffer copy or write weakness that can lead to loss of service.

Apple’s Xcode development environment is affected, specifically all versions that preceded 26.1. The issue applies to Xcode installations running on any Apple platform where a privileged user can interact with the vulnerable component, but no specific patch versions are listed beyond the fix in 26.1.

The CVSS score of 4.9 indicates moderate impact. The EPSS score of less than 1 % shows a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation appears to require a user with privileged network access to the Xcode environment, suggesting that the attack uses a local or network-based privilege to trigger a denial of service.