Xcode CVE-2026-28889

This vulnerability represents high real-world risk despite the absence of published CVSS metrics and EPSS scores. The ability to read arbitrary files as root is a critical technical impact (full information disclosure of sensitive system and application data). The attack vector is local (requiring an attacker to execute code on the same system), but the complexity is likely low since the vulnerability is triggered through normal Xcode functionality rather than requiring complex exploitation. The lack of active KEV designation and public POC does not diminish the severity—privilege escalation from unprivileged application to root-level file read access is inherently exploitable. This should be treated as a critical priority for any organization using Xcode in production or development environments.

An attacker with local code execution capability could craft a malicious application or build tool that triggers Xcode's vulnerable file-reading functionality to access sensitive system files such as SSH keys stored in /root/.ssh, configuration files in /etc, or other privileged system data. Once executed on a developer's machine or build server, the malicious code could leverage the permissions bypass to exfiltrate root-owned files that would normally be inaccessible to unprivileged users, enabling further privilege escalation or lateral movement within the system. The local attack vector and apparent ease of exploitation (based on the 'permissions issue' description) suggest this could be weaponized in supply chain attacks targeting development environments.