What is the CVSS score of CVE-2026-28890?

CVE-2026-28890 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Xcode are affected by CVE-2026-28890?

Organizations using An out-of-bounds read should be aware of moderate risk from CVE-2026-28890, a out-of-bounds read vulnerability rated CVSS 5.5.. A patch is available.

How to fix or mitigate CVE-2026-28890?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Xcode CVE-2026-28890

EUVD-2026-15168 MEDIUM

Out-of-bounds Read (CWE-125)

2026-03-25 apple

GHSA-r6cr-r92c-wf2r

Buffer Overflow Information Disclosure Xcode

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

26.4

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15168

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:32 nvd

MEDIUM 5.5

DescriptionCVE.org

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 26.4. An app may be able to cause unexpected system termination.

AnalysisAI

Xcode versions prior to 26.4 contain an out-of-bounds read vulnerability that can be triggered by local users with user interaction to cause unexpected application or system termination. This denial-of-service condition affects developers and build systems using vulnerable Xcode installations. No patch is currently available.

Technical ContextAI

The vulnerability is rooted in a classic out-of-bounds read condition, which falls under improper input validation and bounds checking mechanisms. This type of flaw typically occurs when code attempts to access memory locations beyond the allocated buffer without verifying array or string boundaries first. In the context of Xcode (Apple's integrated development environment), the affected component likely processes file data, build artifacts, or user input without adequate length validation. The CPE identifier cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:* indicates all versions of Xcode are potentially affected until version 26.4 was released. The root cause class aligns with CWE-125 (Out-of-bounds Read) or related buffer management flaws that are common in C/C++ codebases like Xcode's core components.

RemediationAI

Upgrade Apple Xcode to version 26.4 or later immediately. This is the primary and recommended fix as Apple has specifically patched the out-of-bounds read vulnerability in this release. Users and organizations should access the official Apple Xcode download page or use the Mac App Store to retrieve the latest version, following Apple's standard software update procedures. For development teams unable to upgrade immediately, implement access controls to restrict the use of vulnerable Xcode versions to isolated build environments and monitor for unexpected application terminations or crashes during development workflows. Consult Apple's support page at https://support.apple.com/en-us/126801 for detailed upgrade instructions and any supplementary guidance.