Apple Xcode CVE-2026-86949

Requires a malicious application to already be present and executing on the host within Xcode's app sandbox; the flaw lets that app bypass library validation to load untrusted libraries and break out of the sandbox. Limiting factors: exploitation is LOCAL only (attacker code must run first - e.g. a trojanized developer tool or dependency), it is confined to macOS systems running Xcode prior to version 27, and it provides escalation/escape rather than initial access. No remote or network path and no separate privileged account are needed once the malicious app runs.

This is a local-access sandbox escape in Apple's Xcode, fixed in Xcode 27 and credited to Apple itself. The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C) is internally consistent with the description: a 'malicious app' must already be executing on the host with low privilege inside its sandbox (AV:L, PR:L), requires no user interaction, and the scope change (S:C) plus C:H/I:H/A:H correctly reflect that breaking the sandbox boundary compromises resources beyond the originally authorized component. The headline 8.8 is driven by the scope change, not by remote reach - this is NOT a network-exploitable flaw, so it should not be triaged alongside remote RCEs despite the high number. No EPSS score was provided (unknown exploitation probability), the CVE is NOT on CISA KEV, and no public POC was supplied, so there is no public exploit identified at time of analysis. CWE-829 (inclusion of functionality from an untrusted control sphere) aligns with the stated fix - enforcing library validation - indicating the root cause is loading of attacker-controlled libraries that bypassed validation. Net assessment: a genuine but second-stage privilege/isolation issue requiring prior code execution via a malicious app; real priority for developer/build machines, but materially lower urgency than any unauthenticated network vector, and there is no evidence of active exploitation.

An attacker distributes a malicious application (e.g. via a trojanized tool or dependency aimed at developers) that, once run within its sandbox, abuses the missing library-validation enforcement to load attacker-controlled code and break out of the sandbox, gaining broader access to the host. No user interaction beyond running the app is needed and no public exploit code is currently known.