3.3
Low
CVE-2026-112605 This issue was addressed with improved handling of symlinks
Description
This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files.
CVSS 3.1 detail
Vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitable with local access to the machine, without an account and if a user takes an action; the impact on data or service is limited.
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- None
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Xcode 27.2 | earliest → < 27.2 | 27.2 |
References
- support.apple.com support.apple.com
Timeline
- Published
- Last modified
Other CVEs of Xcode
The 50 CVEs of Xcode →
CVE-2026-112602
An authorization issue was addressed with improved state management
3.3
Low
CVE-2026-86949
This issue was addressed by enforcing library validation on the affected binaries
8.8
High
CVE-2026-86948
This issue was addressed by enforcing library validation on the affected binaries
7.8
High
CVE-2026-86874
An out-of-bounds read was addressed with improved input validation
3.3
Low