{"id":"CVE-2026-86875","kind":"vulnerability","aliases":["CVE-2026-86875"],"related":[],"title":"Xcode: malformed binary parsing crashes apps, fixed in Xcode 27","description":"An input validation issue was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected app termination.","summary":"Xcode has an input validation flaw in how it parses binaries. A maliciously crafted binary can make the app terminate unexpectedly.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ios","macos","other","xcode"],"not_affected_if":["no-untrusted-binaries"],"how_to_check":"- Run `xcodebuild -version` to see the installed Xcode version.\n- unknown","fix":"- Update Xcode to `27` or later.","status":"open","published_at":"2026-10-20T01:17:25+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T04:39:28+00:00","updated_at":"2026-10-25T04:39:28+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:39:28Z","model":"claude-haiku-5-5","output":{"fix":"- Update Xcode to `27` or later.","reach":"local","title":"Xcode: malformed binary parsing crashes apps, fixed in Xcode 27","impact":"low","summary":"Xcode has an input validation flaw in how it parses binaries. A maliciously crafted binary can make the app terminate unexpectedly.","category":"other","nicknames":[],"who_cares":["xcode","macos","ios"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Unexpected app termination; no code execution stated.","analyst_note":"","how_to_check":"- Run `xcodebuild -version` to see the installed Xcode version.\n- unknown","needs_analyst":false,"not_affected_if":["no-untrusted-binaries"],"who_is_affected":"Teams that run Xcode on developer machines or build agents and parse binaries from untrusted sources. The sources do not say which specific binary formats or tools trigger the flaw. unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000512,"input_tokens":3254,"output_tokens":374,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-86875':13A,16A '27':10A,58C 'address':47C 'app':6A,39B,68C 'binari':3A,31B,35B,63C 'craft':34B,62C 'crash':5A 'cve':11A,14A 'fix':7A,55C 'flaw':26B 'improv':49C 'input':24B,43C,50C 'io':17B 'issu':45C,53C 'lead':65C 'maco':18B 'make':37B 'malform':2A 'malici':33B,61C 'may':64C 'pars':4A,30B,59C 'termin':40B,69C 'unexpect':41B,67C 'valid':25B,44C,51C 'xcode':1A,9A,20B,21B,57C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Xcode on developer machines or build agents and parse binaries from untrusted sources. The sources do not say which specific binary formats or tools trigger the flaw. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86875","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86875","severity":null,"published_at":"2026-10-20T01:17:25+00:00","modified_at":"2026-10-20T15:17:34+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}