{"id":"CVE-2026-86874","kind":"vulnerability","aliases":["CVE-2026-86874"],"related":[],"title":"Xcode: crafted binary parsing out-of-bounds read crashes the tool","description":"An out-of-bounds read was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected tool termination.","summary":"Xcode's parser reads past the end of a buffer when it processes a maliciously crafted binary. The result is that the tool terminates unexpectedly, and the sources do not describe code execution.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ios","macos","runtime","xcode"],"not_affected_if":["trusted-binaries-only"],"how_to_check":"- Run `xcodebuild -version` and compare the Xcode version against the fixed release\n- unknown","fix":"- Update Xcode to `27` or later\n- unknown","status":"open","published_at":"2026-10-20T01:17:25+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T04:46:08+00:00","updated_at":"2026-10-25T04:46:08+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T04:46:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update Xcode to `27` or later\n- unknown","reach":"local","title":"Xcode: crafted binary parsing out-of-bounds read crashes the tool","impact":"low","summary":"Xcode's parser reads past the end of a buffer when it processes a maliciously crafted binary. The result is that the tool terminates unexpectedly, and the sources do not describe code execution.","category":"runtime","nicknames":[],"who_cares":["xcode","macos","ios"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Xcode crashes while parsing a crafted binary","analyst_note":"","how_to_check":"- Run `xcodebuild -version` and compare the Xcode version against the fixed release\n- unknown","needs_analyst":false,"not_affected_if":["trusted-binaries-only"],"who_is_affected":"Teams that run Xcode on machines that open or build untrusted binaries are the ones to check. The sources do not say which Xcode versions are affected beyond the fix in Xcode 27, and they do not describe a remote trigger. Teams that only build their own trusted code have less reason to hurry.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000542,"input_tokens":3260,"output_tokens":432,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-86874':15A,18A '27':74C 'address':63C 'binari':3A,39B,79C 'bound':8A,60C 'buffer':32B 'code':54B 'craft':2A,38B,78C 'crash':10A 'cve':13A,16A 'describ':53B 'end':29B 'execut':55B 'fix':71C 'improv':65C 'input':66C 'io':19B 'issu':69C 'lead':81C 'maco':20B 'malici':37B,77C 'may':80C 'out-of-bound':5A,57C 'pars':4A,75C 'parser':25B 'past':27B 'process':35B 'read':9A,26B,61C 'result':41B 'runtim':21B 'sourc':50B 'termin':46B,85C 'tool':12A,45B,84C 'unexpect':47B,83C 'valid':67C 'xcode':1A,22B,23B,73C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Xcode on machines that open or build untrusted binaries are the ones to check. The sources do not say which Xcode versions are affected beyond the fix in Xcode 27, and they do not describe a remote trigger. Teams that only build their own trusted code have less reason to hurry.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86874","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86874","severity":null,"published_at":"2026-10-20T01:17:25+00:00","modified_at":"2026-10-20T15:17:34+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}