Apple Xcode CVE-2026-86874

Requires a local developer workflow: the victim must run an affected Xcode binary-parsing tool (Xcode prior to version 27) against an attacker-supplied, maliciously crafted binary file. Exploitation is LIMITED by (1) local attack vector - the malformed file must reach a machine running Xcode and be fed to the vulnerable tool; (2) the need for the user/toolchain to actually parse the attacker's file; (3) impact ceiling of a single tool crash (no RCE, no data disclosure given C:N/I:N); and (4) version - fixed in Xcode 27, so only installs below 27 are affected. There is no network-exposed, unauthenticated path.

This is a genuinely low-priority issue and the signals are consistent in saying so. The CVSS 3.1 base score is 3.3 (Low) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - a local attack vector, low complexity, and the ONLY impact is to availability (A:L), with no confidentiality or integrity impact (C:N/I:N). That availability impact is scoped to a single tool crash, not the host. EPSS reinforces this: 0.15% probability at the 3rd percentile, i.e. near the bottom of the exploitation-likelihood distribution. CISA's SSVC decision framework agrees across all three axes - Exploitation: none, Automatable: no, Technical Impact: partial - which maps to a 'Track' (not 'Act') disposition. There is no KEV listing and no POC referenced, so this is 'no public exploit identified at time of analysis.' One cross-source tension worth noting: the input Tags include 'Information Disclosure' and 'Buffer Overflow,' and the CWE is CWE-125 (out-of-bounds READ, which can leak memory), yet both the description ('unexpected tool termination') and the CVSS vector (C:N) describe a denial-of-service / crash outcome with NO disclosure. Treat the 'Information Disclosure' tag as unsupported by the authoritative data. Net: a low-CVSS, low-real-risk developer-tooling bug, not an operational priority.

An attacker crafts a malformed binary (e.g., a Mach-O/object file) and gets a macOS developer to process it with an Xcode command-line or build tool. When the tool parses the malformed structure it reads out of bounds and crashes. No public exploit code is referenced, the impact is limited to the tool terminating (no code execution or data leak), and exploitation requires local access to a machine running the affected tool.