EUVD-2026-104713
GHSA-hvq8-f33h-4x63
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted binary to developer
-
ExploitDeveloper opens file in Xcode
-
ExecutionMalformed binary parsed without validation
-
ImpactXcode terminates unexpectedly (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires a developer to open or process an attacker-supplied maliciously crafted binary in Xcode prior to version 27; the vulnerable code path is Xcode's binary-parsing routine (CWE-20 input validation). Limiting factors: mandatory user interaction (UI:R) - the victim must actively load the malicious file - and the impact is confined to crashing the Xcode application (A:L only), with no confidentiality, integrity, or code-execution consequences. Because the target is a developer IDE rather than a server, realistic exploitation depends on social-engineering a developer into opening the crafted artifact. |
| Impact | This is a low-severity denial-of-service issue (CVSS 4.3), and every independent signal agrees on low real-world priority. The CVSS vector shows no confidentiality or integrity impact (C:N/I:N) and only limited availability impact (A:L) manifesting as 'unexpected app termination' - i.e., an Xcode crash, not code execution. EPSS is 0.15% (3rd percentile), SSVC scores Exploitation:none / Automatable:no / Technical Impact:partial, there is no CISA KEV listing and no public POC, so exploitation status is 'no public exploit identified at time of analysis.' The signals are mutually consistent - nothing here is conflicting. One caveat worth flagging: the vendor-supplied vector is AV:N, but the attack is parsing a malicious binary inside a developer IDE, which in practice requires the file to be delivered to and opened on the local machine; I assess this as effectively local file-parsing (see my independent vector). Also note the input tag 'Information Disclosure' contradicts the CVSS (C:N) and the description - the actual impact is availability/DoS, so that tag appears mislabeled. Bottom line: genuine but minor; a crash-only bug in developer tooling, appropriately deprioritized relative to its already-low CVSS. |
| Exploit ScenarioDerived | An attacker distributes a maliciously crafted binary (e.g., a library, framework, or project artifact) to a developer, who opens or processes it in a vulnerable Xcode version. When Xcode parses the malformed binary, the input-validation flaw triggers an unexpected crash of the IDE. No public exploit code is known, and user interaction (opening the file) is required; impact is limited to application termination with no code execution or data exposure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Parsing a maliciously crafted binary in Apple Xcode prior to version 27 can terminate the IDE unexpectedly, giving an attacker who convinces a developer to open a booby-trapped file a denial-of-service primitive against the developer's workstation. The flaw is an input-validation weakness (CWE-20) in Xcode's binary-parsing path and requires user interaction - the victim must actively load the crafted artifact - with impact limited to application availability (A:L only, no confidentiality, integrity, or code-execution consequences). Independent signals agree on low priority: EPSS is 0.15% (3rd percentile), CISA SSVC records exploitation as none and automatable as no, there is no KEV listing, and no public exploit code has been identified at time of analysis. Note that the supplied base vector (AV:N) is more permissive than our assessed local attack vector (AV:L); the practical threat model is social engineering a developer into opening the file rather than a remotely reachable service.
RemediationAI
Vendor-released patch: upgrade to Xcode 27 (Apple advisory https://support.apple.com/en-us/149040), which replaces the faulty validation logic; because the defect is local to the IDE, installing the fixed release fully removes exposure and no configuration change is needed afterward. If upgrading must be deferred, reduce the attack surface by treating all binaries and object files from untrusted or unexpected sources (email attachments, shared drives, downloaded sample code, third-party SDK bundles) as hostile and inspecting them only inside a disposable virtual machine or a separate sandboxed macOS user account with App Sandbox and no access to signing credentials - the trade-off is slower triage and a second environment to maintain, plus sample inspection in a VM may not reflect the exact toolchain behavior of the host. Avoid enabling automatic analysis of arbitrary dropped files and keep crash reporting enabled so that unexpected Xcode terminations on file open are recorded and correlated. Restricting the ability of unprivileged accounts to install arbitrary developer tooling add-ons reduces the chance of a tampered parser being introduced, at the cost of some developer workflow friction. There is no server-side network control to apply here, since exploitation requires the developer to open the crafted artifact; security-awareness guidance not to open binaries from unsolicited sources is the primary residual control, and deleting the offending file rather than re-opening it prevents repeated crashes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-20 (Improper Input Validation) in the binary-parsing routines of Xcode, Apple's macOS integrated development environment, which ingests Mach-O executables, object files, archives and debug symbols through its toolchain-facing components (debugger, linker and file-inspection machinery). A crafted binary with malformed structure - for example inconsistent load commands, section or segment metadata - is not rejected cleanly by the validator, so the parsing routine faults and the Xcode process is torn down instead of returning a controlled error. The CPE cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:* and EUVD's version range 'Xcode 0 <27' confirm the entire release history before 27 is in scope; Apple corrected the issue by tightening input validation in Xcode 27. Because the target is a developer IDE rather than a network service, exploitation is not automatable (SSVC Automatable: no): it depends on delivering the crafted file and inducing the developer to load it, and the only outcome is a crash of the tool, meaning partial technical impact rather than code execution or data exposure. No memory-corruption or privilege-escalation consequence is described in the available data.
Know when Xcode gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
A crafted binary must be delivered and opened locally in the IDE, so AV:L and UI:R; crash-only impact gives C:N/I:N/A:L with no privileges needed (PR:N).
Primary rating from Vendor (apple).
CVSS VectorVendor: apple
Lifecycle Timeline
4DescriptionCVE.org
An input validation issue was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary may lead to unexpected app termination.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Related Vulnerabilities in Xcode Binary Parsing and Sandbox Escape Flaws
View all 4Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range fi
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid
Git contains a CRLF injection vulnerability (CVE-2025-48384, CVSS 8.0) in its config handling that allows attackers to e
Git is an open-source distributed revision control system. Rated high severity (CVSS 7.5), this vulnerability is remotel
visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the docu
SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (becau
Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attacke
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way pa
An issue was discovered in certain Apple products. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote
Exploit-DB