CVEsAppleCVE-2026-112605Published Oct 30, 00:26 · Updated Oct 30, 00:26 UTC
–
Not scored
CVE-2026-112605

This issue was addressed with improved handling of symlinks.

Xcode
AffectedXcode
FixUpdate to 27.2 or newer
PublishedOct 30, 00:26 · apple
ScoredNot yet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC

What we know

No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
No severity score yet.

Description

This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files.

From apple

Affected and fixed versions

ProductAffectedFixed inXcodebefore 27.227.2

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

support.apple.com/en-us/149589 · support.apple.com

Other CVEs in Xcode

All 45 →
–An authorization issue was addressed with improved state management. · CVE-2026-112602Oct 308.8This issue was addressed by enforcing library validation on the affected binaries. · CVE-2026-86949Oct 207.8This issue was addressed by enforcing library validation on the affected binaries. · CVE-2026-86948Oct 20