An out-of-bounds read under certain conditions allows an application to trigger an unexpected system termination. The vulnerability occurs when input bounds are not properly validated, leading to a read of memory outside the intended array. This can cause Xcode or the host system to crash, compromising availability but not confidentiality or integrity. The weakness corresponds to CWE-125: Out-of-Bounds Read.

The issue affects Apple Xcode releases prior to version 26.4. Users running any Xcode installer older than 26.4 are potentially vulnerable. The update introduced improved bounds checking to eliminate the flaw.

With a CVSS base score of 5.5, the vulnerability is considered medium severity. The EPSS score is below 1%, indicating a low probability of exploitation in the wild. Because the flaw appears to require execution of rogue code within an Xcode project, it is most likely exploitable only by local users with access to the development environment; remote exploitation is not documented. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited real-world impact. The likely attack vector is local execution within Xcode.