---
id: "CVE-2026-65393"
page: "https://infrastack.ai/live/CVE-2026-65393"
kind: "vulnerability"
aliases: ["CVE-2026-65393"]
title: "A permissions issue was addressed with improved validation"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "apple xcode", "fixed": ["27.0"], "affected": "< 27.0", "ecosystem": "vendor"}, {"name": "apple macos", "fixed": ["27.0"], "affected": "< 27.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apple", "apple-developers", "macos", "vendor", "vendor-advisory", "xcode"]
not_affected_if: ["xcode-not-used"]
published_at: "2026-09-14T21:17:22+00:00"
first_seen_at: "2026-11-12T20:57:53+00:00"
updated_at: "2026-11-12T21:11:28+00:00"
sources: [{"source": "lab", "url": "https://support.apple.com/en-us/149040", "first_seen_at": "2026-11-12T20:57:53+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65393", "first_seen_at": "2026-11-12T21:11:28+00:00"}]
exploit_sources: []
---

# A permissions issue was addressed with improved validation

Link for people: https://infrastack.ai/live/CVE-2026-65393 (this .md is for agents)

Apple's Xcode 27 Xcode IDE component had a permissions validation flaw that let an app access user-sensitive data. Apple's advisory credits the finding to Mickey Jin and lists the impact as data access by an app.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:apple xcode affected < 27.0 fixed 27.0
- vendor:apple macos affected < 27.0 fixed 27.0

## Timeline

- 2026-11-12T20:57:53+00:00 lab https://support.apple.com/en-us/149040 — Apple: About the security content of Xcode 27 - Apple Support
- 2026-11-12T21:11:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65393

## Documents

- [advisory] Apple: About the security content of Xcode 27 - Apple Support https://support.apple.com/en-us/149040
- [advisory] Apple: About the security content of macOS Golden Gate 27 - Apple Support https://support.apple.com/en-us/149035

## From the sources

About the security content of Xcode 27 - Apple Support

# About the security content of Xcode 27

This document describes the security content of Xcode 27.

## About Apple security updates

For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security releases page.

Apple security documents reference vulnerabilities by CVE-ID when possible.

For more information about security, see the Apple Product Security page.

## Xcode 27

Released September 14, 2026

### App Store

Available for: macOS Tahoe 26.6 and later

Impact: An app may be able to break out of its sandbox

Description: This issue was addressed by enforcing library validation on the affected binaries.

CVE-2026-86948: Ilya Andr (andrd3v) of Positive Technologies

Entry added October 19, 2026

### CoreSymbolication

Available for: macOS Tahoe 26.6 and later

Impact: Parsing a maliciously crafted binary may lead to unexpected app termination

Description: An input validation issue was addressed with improved input validation.

CVE-2026-86875: Egor Saltykov

Entry added October 19, 2026

### otool

Available for: macOS Tahoe 26.6 and later

Impact: Parsing a maliciously crafted binary may lead to unexpected tool termination

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2026-86874: Eddy T

Entry added October 19, 2026

### Xcode

Available for: macOS Tahoe 26.6 and later

Impact: A malicious app may be able to break out of its sandbox

Description: This issue was addressed by enforcing library validation on the affected binaries.

CVE-2026-86949: Ilya Andr (andrd3v) of Positive Technologies

Entry added October 19, 2026

### Xcode IDE

Available for: macOS Tahoe 26.6 and later

Impact: An app may be able to access user-sensitive data

Description: A permissions issue was addressed with improved validation.

CVE-2026-65393: Mickey Jin (@patch1t)

## Additional recognition

### otool

We would like to acknowledge Eddy T for their assistance.

### Swift

We would like to acknowledge Owais Lone (thesecguy), Yuval Fradkin for their assistance.

### tapi

We would like to acknowledge Jian Lee (@speedyfriend433) for their assistance.

### Xcode IDE

We would like to acknowledge Yiğit Can YILMAZ (@yilmazcanyigit) for their assistance.

 Published Date: October 19, 2026

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_