A flaw in Apple Xcode allows an application to read any file with root permissions, effectively granting the attacker elevated system privileges and enabling access to sensitive data. This is an improper privilege management issue that can be exploited to exfiltrate confidential files or information that should be restricted to the operating system. No denial of service or remote code execution is described, but the ability to read root–protected files directly violates confidentiality and integrity.

Apple Xcode versions prior to 26.4 are affected. The vulnerability is fixed in the 26.4 release, so any installation running an older revision remains vulnerable until an update is installed.

The CVSS score of 6.2 indicates a medium severity level, and the EPSS score of less than 1% implies that exploitation is not expected to be widespread. The flaw is not listed in the CISA KEV catalog, further indicating limited current exploitation. Based on the description, the attack vector is inferred to be local or developer‑based, where a malicious or improperly configured application within Xcode could read arbitrary files. No public exploit or zero‑day kit has been reported, but the issue remains serious enough to warrant timely patching.