CVE-2026-86949

8.8High

Published 20 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

8.8High

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-829

Impact

A malicious local app can escape its sandbox to access host resources. The attacker must already be able to execute code locally on the system.

Root cause

Binaries failed to enforce library validation, permitting the loading of untrusted code across sandbox boundaries.

Affected systems

Xcode versions prior to 27.

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Fix & remediation

Upgrade to Xcode 27 or later. No workaround or interim mitigation is provided.

shell

$ xcodebuild -version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.

References

https://support.apple.com/en-us/149040

Source: nvd.nist.gov/vuln/detail/CVE-2026-86949