Description
An input validation issue was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected app termination.
Published: 2026-10-20
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Application Crash (Denial of Service)
Action: Apply Update
AI Analysis

Impact

An input validation flaw was addressed with improved input validation. When Xcode parses a maliciously crafted binary, the application may terminate unexpectedly, causing a denial of service for the developer or build process.

Affected Systems

Apple Xcode versions prior to 27 are affected. Version 27 and later contain the fix.

Risk and Exploitability

The vulnerability appears to require local execution of a malicious binary within Xcode. The EPSS score of <1% indicates a very low likelihood of exploitation, and the issue is not listed in CISA KEV. The CVSS score of 4.3 reflects moderate severity. The lack of remote execution or widespread availability of the malicious binary suggests a moderate risk rather than a high‑severity threat, but the impact of an unexpected crash can disrupt development workflows. Prevention requires updating Xcode to the fixed version and avoiding untrusted binaries until the update is applied.

Generated by OpenCVE AI on October 20, 2026 at 18:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Xcode to version 27 or later to obtain the fixed input validation.
  • Avoid opening or compiling untrusted or malicious binaries in Xcode as a temporary precaution.
  • Implement strict code review and validation of third‑party binary inputs to prevent exploitation until the update can be deployed.

Generated by OpenCVE AI on October 20, 2026 at 18:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://support.apple.com/en-us/149040 cve-icon cve-icon
History

Thu, 29 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*

Tue, 20 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
Title Input Validation in Xcode Leads to Unexpected App Termination

Tue, 20 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Title Input Validation in Xcode Leads to Unexpected App Termination
Weaknesses CWE-20

Tue, 20 Oct 2026 04:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple xcode
Vendors & Products Apple
Apple xcode

Tue, 20 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Description An input validation issue was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected app termination.
References

Subscriptions

Apple Xcode
cve-icon MITRE

Status: PUBLISHED

Assigner: apple

Published:

Updated: 2026-10-20T14:54:14.751Z

Reserved: 2026-09-08T16:43:41.871Z

Link: CVE-2026-86875

cve-icon Vulnrichment

Updated: 2026-10-20T14:54:06.813Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T01:17:25.557

Modified: 2026-10-29T15:55:03.267

Link: CVE-2026-86875

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T18:30:16Z

Weaknesses
  • CWE-20

    Improper Input Validation