Live › vulnerability › CVE-2026-86874
Go to dashboardXcode's parser reads past the end of a buffer when it processes a maliciously crafted binary. The result is that the tool terminates unexpectedly, and the sources do not describe code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run Xcode on machines that open or build untrusted binaries are the ones to check. The sources do not say which Xcode versions are affected beyond the fix in Xcode 27, and they do not describe a remote trigger. Teams that only build their own trusted code have less reason to hurry.
No product ranges from the sources yet.
xcodebuild -version and compare the Xcode version against the fixed release27 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An out-of-bounds read was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected tool termination.
This page as .md · .json · in your agent: get_signal("CVE-2026-86874")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.