Live › vulnerability › CVE-2026-86949
Go to dashboardA malicious app can break out of its macOS sandbox because some binaries shipped with Xcode did not enforce library validation. Apple fixed it in Xcode 27 (released Sept 14, 2026; advisory entry added Oct 19). Apple lists the affected platform as macOS Tahoe 26.6 and later. No exploitation reported.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Xcode | vendor | < 27 | 27 |
xcodebuild -version in a terminalUpdate Xcode to 27 or later, from the Mac App Store or developer.apple.com.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.
This page as .md · .json · in your agent: get_signal("CVE-2026-86949")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.