APPLE XCODE · CVE-2026-65393 · Vendor
FIX → 27.0
Apple's Xcode 27 Xcode IDE component had a permissions validation flaw that let an app access user-sensitive data. Apple's advisory credits the finding to Mickey Jin and lists the impact as data access by an app.
first public Sep 14, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
The advisory covers Xcode 27 on macOS Tahoe 26.6 and later; it does not say which Xcode IDE configuration or workflow is needed to trigger the flaw. Teams that build Apple software with Xcode 27 are the ones to look at. Teams not using Xcode 27 can skip it.
Not affected if xcode-not-used
Who cares apple, apple-developers, macos, vendor-advisory, xcode
Unknown from the sources.
Upgrade to 27.0
About the security content of Xcode 27 - Apple Support
This document describes the security content of Xcode 27.
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.
Apple security documents reference vulnerabilities by CVE-ID when possible.
For more information about security, see the Apple Product Security page.
Released September 14, 2026
Available for: macOS Tahoe 26.6 and later
Impact: An app may be able to break out of its sandbox
Description: This issue was addressed by enforcing library validation on the affected binaries.
CVE-2026-86948: Ilya Andr (andrd3v) of Positive Technologies
Entry added October 19, 2026
Available for: macOS Tahoe 26.6 and later
Impact: Parsing a maliciously crafted binary may lead to unexpected app termination
Description: An input validation issue was addressed with improved input validation.
CVE-2026-86875: Egor Saltykov
Entry added October 19, 2026
Available for: macOS Tahoe 26.6 and later
Impact: Parsing a maliciously crafted binary may lead to unexpected tool termination
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Description: An out-of-bounds read was addressed with improved input validation.
CVE-2026-86874: Eddy T
Entry added October 19, 2026
Available for: macOS Tahoe 26.6 and later
Impact: A malicious app may be able to break out of its sandbox
Description: This issue was addressed by enforcing library validation on the affected binaries.
CVE-2026-86949: Ilya Andr (andrd3v) of Positive Technologies
Entry added October 19, 2026
Available for: macOS Tahoe 26.6 and later
Impact: An app may be able to access user-sensitive data
Description: A permissions issue was addressed with improved validation.
CVE-2026-65393: Mickey Jin (@patch1t)
We would like to acknowledge Eddy T for their assistance.
We would like to acknowledge Owais Lone (thesecguy), Yuval Fradkin for their assistance.
We would like to acknowledge Jian Lee (@speedyfriend433) for their assistance.
We would like to acknowledge Yiğit Can YILMAZ (@yilmazcanyigit) for their assistance.
Published Date: October 19, 2026
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.