AppleCVE-2026-86948

Apple Xcode: untrusted functionality included

CVE-2026-86948 · Published Oct 20, 2026 · updated Oct 30, 2026

High8.8

Fix: upgrade to 27 or later

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox.

Affected versions

Package	Affected	Fixed in
Xcode Product	< 27	27

Details and references

CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity from: NVD
Weakness: CWE-829, CWE-284, CWE-693

More Apple advisories

All Apple

High 7.5Oct 20

Apple iOS and iPadOS: improper authorizationCVE-2026-86977fixed in 27 Medium 5.5Oct 20

Apple macOS: information disclosureCVE-2026-86979fixed in 27 Medium 5.5Oct 20

Apple macOS: out-of-bounds writeCVE-2026-86981fixed in 15.8 +1 Medium 5.5Oct 20

Apple macOS: information disclosureCVE-2026-86940fixed in 27 Medium 5.5Oct 20

Apple iOS and iPadOS: out-of-bounds writeCVE-2026-86944fixed in 26.7 +2 High 8.8Oct 20

Apple Xcode: untrusted functionality includedCVE-2026-86949fixed in 27