---
id: "CVE-2026-86948"
kind: "vulnerability"
aliases: ["CVE-2026-86948"]
title: "Xcode: app can escape its sandbox through unvalidated library loading"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["apple-developers", "infrastructure", "macos", "xcode"]
not_affected_if: ["unknown"]
published_at: "2026-10-20T01:17:28+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-25T05:06:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86948", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# Xcode: app can escape its sandbox through unvalidated library loading

Apple's Xcode 27 fixes a flaw in which an app may be able to break out of its sandbox. Apple's fix enforces library validation on the affected binaries.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `xcodebuild -version` to see the installed Xcode version
- unknown

## Fix

- Update Xcode to 27 or later
- unknown

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86948

## From the sources

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_