An out‑of‑bounds write flaw was discovered in Xcode. When the application processes a maliciously crafted file, the vulnerability writes past the end of a buffer, corrupting heap memory. The CVE description confirms that the result is heap corruption, and such corruption can give an attacker the ability to modify program state—including control flow—potentially allowing arbitrary code execution on the local machine.

Apple Xcode versions before 26.1 are impacted. The issue is fixed in Xcode 26.1 and later releases; any earlier edition is vulnerable when it opens an attacker‑supplied file.

The CVSS score of 8.8 categorises the weakness as high severity, while the EPSS score of <1% indicates a low likelihood of exploitation in the wild. The vulnerability is not included in CISA’s KEV list, and the attack vector is inferred to be local, requiring an attacker to supply or trick a user into opening a malicious file. Although exploitation is not guaranteed to result in remote code execution, the potential for arbitrary code execution makes it a critical asset to address.