AppleCVE-2026-86874

Apple Xcode: out-of-bounds read

CVE-2026-86874 · Published Oct 20, 2026 · updated Oct 29, 2026

Low3.3

Fix: upgrade to 27 or later

An out-of-bounds read was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected tool termination.

Affected versions

Package	Affected	Fixed in
Xcode Product	< 27	27

Details and references

CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Severity from: CISA (its enrichment of the CVE record)
Weakness: CWE-125

More Apple advisories

All Apple

High 7.5Oct 20

Apple iOS and iPadOS: improper authorizationCVE-2026-86977fixed in 27 Medium 5.5Oct 20

Apple macOS: information disclosureCVE-2026-86979fixed in 27 Medium 5.5Oct 20

Apple macOS: out-of-bounds writeCVE-2026-86981fixed in 15.8 +1 Medium 5.5Oct 20

Apple macOS: information disclosureCVE-2026-86940fixed in 27 Medium 5.5Oct 20

Apple iOS and iPadOS: out-of-bounds writeCVE-2026-86944fixed in 26.7 +2 High 8.8Oct 20

Apple Xcode: untrusted functionality includedCVE-2026-86948fixed in 27