3.3 Low

CVE-2026-112602 An authorization issue was addressed with improved state management

Description

An authorization issue was addressed with improved state management. This issue is fixed in Xcode 27.2. An app may be able to access sensitive user data.

CVSS 3.1 detail

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Exploitable with local access to the machine, without an account and if a user takes an action; the impact on data or service is limited.

Attack vector: Local
Attack complexity: Low
Privileges required: None
Interaction: Required
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
Xcode 27.2	earliest → < 27.2	27.2

References

support.apple.com support.apple.com

Timeline

Published October 30, 2026
Last modified November 4, 2026

The 50 CVEs of Xcode →

CVE-2026-112605 This issue was addressed with improved handling of symlinks 3.3 Low CVE-2026-86949 This issue was addressed by enforcing library validation on the affected binaries 8.8 High CVE-2026-86948 This issue was addressed by enforcing library validation on the affected binaries 7.8 High CVE-2026-86874 An out-of-bounds read was addressed with improved input validation 3.3 Low

Track this CVE