CVE-2024-40862

A privacy issue in Apple Xcode (specifically within the IDE Tools component) allows an attacker to potentially determine the Apple ID of the computer owner. This vulnerability was caused by the presence of sensitive data, which has been addressed by removing such information. The issue is resolve...

CVE-2019-8739

CVE-2019-8739 affects Apple’s Xcode toolchain, specifically the otool component. A memory corruption issue in otool could be triggered by processing a maliciously crafted file, potentially enabling arbitrary code execution. Apple’s security content confirms the fix in Xcode 11.0 and advises upgra...

CVE-2017-7167

CVE-2017-7167 affects Apple Xcode before 9.2, where the ld64 linker component contains a buffer overflow. The flaw allows arbitrary code execution with user privileges when compiling with untrusted sources, leading to a high-severity outcome in the 3.0 CVSS (local, exploitable with no user intera...

CVE-2019-8738

CVE-2019-8738 affects the otool component of Apple Xcode prior to version 11.0. It is a memory corruption issue that could allow arbitrary code execution when processing a maliciously crafted file. Apple fixed this in Xcode 11.0 by updating the affected component and improving state management. T...

CVE-2026-28890

The Xcode integrated development environment for macOS (available for macOS Tahoe 26.2 and later) is vulnerable to an out-of-bounds read in the otool component. This flaw is caused by insufficient bounds checking, which could allow an application to cause unexpected system termination . The issue...

CVE-2025-43263

The Xcode integrated development environment for MacOS is vulnerable to an improper access control issue within the IDE CoreML component. Due to insufficient sandbox checking , an attacker could bypass sandbox protection mechanisms, allowing an application to read and write files outside of its d...

CVE-2025-43371

The Xcode integrated development environment for macOS is vulnerable to an Improper Access Control issue within the CoreML component . The root cause is insufficient sandbox checking , which could allow an attacker to bypass sandbox protection mechanisms and cause an application to break out of i...

CVE-2025-43370

The Xcode integrated development environment for macOS operating systems contains a path handling vulnerability in its Dev Tools component. The root cause is the copying of buffers without sufficient validation of the input data size (CWE-120). An attacker can exploit this by providing an overly ...

CVE-2025-43505

Apple Xcode versions prior to 26.1 are vulnerable to an out-of-bounds write issue caused by insufficient input validation . An attacker could exploit this by providing a maliciously crafted file , which may lead to heap corruption . The vulnerability has been addressed in Xcode 26.1 through impro...

CVE-2025-43375

The Xcode integrated development environment for macOS is vulnerable to a denial of service flaw within the Dev Tools component. The root cause is improper input validation , specifically the copying of buffers without verifying the size of the input data. Processing an overly large path value ca...

CVE-2025-31186

Versions of Apple Xcode prior to 16.3 are vulnerable to a permissions issue that could allow applications to bypass privacy preferences . This vulnerability was addressed with additional restrictions in the Xcode 16.3 update. Exploitation details are not provided.

CVE-2026-65393

A permissions issue in the Xcode IDE (available for macOS Tahoe 26.6 and later) was addressed with improved validation. This vulnerability could allow an app to access user-sensitive data . The issue is fixed in Xcode 27 and macOS Golden Gate 27 . No specific exploit details or in-the-wild exploi...

CVE-2025-43504

A buffer overflow vulnerability exists in the LLDB debugserver component used by Xcode during iOS device debugging. A remote user can trigger this by sending an unauthenticated qSpeedTest:response_size:; packet to the debugserver via a GDB-remote session. The issue stems from an insufficient boun...

CVE-2026-28889

The Xcode Simulator component (available for macOS Tahoe 26.2 and later) is vulnerable to a permissions issue that could allow an app to read arbitrary files as root . The root cause is attributed to insufficient permissions, which has been addressed in Xcode 26.4 through the implementation of ad...