Apple Xcode
48 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-86949 | < 27 | This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be a | HIGH 8.8 | 0.1 % | ||
| CVE-2026-86948 | < 27 | This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to br | 0.2 % | |||
| CVE-2026-86875 | < 27 | An input validation issue was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binar | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-86874 | < 27 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in Xcode 27. Parsing a maliciously crafted binary ma | LOW 3.3 | 0.1 % | ||
| CVE-2026-65393 | < 27 | A permissions issue was addressed with improved validation. This issue is fixed in Xcode 27, macOS Golden Gate 27. An app may be able to acc | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-28890 | < 26.4 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 26.4. An app may be able to cause unexpected | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-28889 | < 26.4 | A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 26.4. An app may be able to read arbitrary file | MEDIUM 6.2 | 0.1 % | ||
| CVE-2025-31186 | < 16.3 | A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy pref | LOW 3.3 | 0.2 % | ||
| CVE-2025-43504 | < 26.1 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position ma | MEDIUM 4.9 | 0.4 % | ||
| CVE-2025-43505 | < 26.1 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously craft | HIGH 8.8 | 0.3 % | ||
| CVE-2025-43375 | < 26 | The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process. | HIGH 7.5 | 0.3 % | ||
| CVE-2025-43263 | < 26 | The issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to read and write files outside of its san | HIGH 7.1 | 0.2 % | ||
| CVE-2025-43371 | < 26 | This issue was addressed with improved checks. This issue is fixed in Xcode 26. An app may be able to break out of its sandbox. | HIGH 8.2 | 0.2 % | ||
| CVE-2025-43370 | < 26 | A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may cra | MEDIUM 4.0 | 0.3 % | ||
| CVE-2025-30441 | < 16.3 | This issue was addressed through improved state management. This issue is fixed in Xcode 16.3. An app may be able to overwrite arbitrary fil | MEDIUM 5.5 | 0.2 % | ||
| CVE-2025-24226 | < 16.3 | The issue was addressed with improved checks. This issue is fixed in Xcode 16.3. A malicious app may be able to access private information. | MEDIUM 5.5 | 0.3 % | ||
| CVE-2024-44228 | < 16 | This issue was addressed with improved permissions checking. This issue is fixed in Xcode 16. An app may be able to inherit Xcode permission | HIGH 7.5 | 0.4 % | ||
| CVE-2024-44191 | < 16 | This issue was addressed through improved state management. This issue is fixed in Xcode 16, iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, | MEDIUM 5.5 | 0.3 % | ||
| CVE-2024-40862 | < 16 | A privacy issue was addressed by removing sensitive data. This issue is fixed in Xcode 16. An attacker may be able to determine the Apple ID | HIGH 7.5 | 0.5 % | ||
| CVE-2024-44162 | < 16 | This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user's | HIGH 7.8 | 0.2 % | ||
| CVE-2024-23298 | < 15.3 | A logic issue was addressed with improved state management. This issue is fixed in Xcode 15.3. An app may bypass Gatekeeper checks. | MEDIUM 5.5 | 0.5 % | ||
| CVE-2023-40435 | unspecified – < 15 | This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 15. An app may be able to access App Store credentials. | MEDIUM 5.5 | 0.3 % | ||
| CVE-2023-40391 | unspecified – < 15 | The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, macOS Sonoma 14, Xcode 15. An a | MEDIUM 5.5 | 0.3 % | ||
| CVE-2023-32396 | unspecified – < 15 | This issue was addressed with improved checks. This issue is fixed in Xcode 15, tvOS 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. | HIGH 7.8 | 0.3 % | ||
| CVE-2022-32920 | unspecified – < 14.0 | The issue was addressed with improved checks. This issue is fixed in Xcode 14.0. Parsing a file may lead to disclosure of user information. | MEDIUM 5.5 | 0.2 % | ||
| CVE-2023-27967 | unspecified – < 14.3 | The issue was addressed with improved memory handling. This issue is fixed in Xcode 14.3. An app may be able to execute arbitrary code out o | HIGH 8.6 | 0.2 % | ||
| CVE-2023-27945 | unspecified – < 14.3 | This issue was addressed with improved entitlements. This issue is fixed in Xcode 14.3, macOS Big Sur 11.7.7, macOS Monterey 12.6.6. A sandb | MEDIUM 6.3 | 0.2 % | ||
| CVE-2022-42797 | unspecified – < 14.1 | An injection issue was addressed with improved input validation. This issue is fixed in Xcode 14.1. An app may be able to gain root privileg | HIGH 7.8 | 0.3 % | ||
| CVE-2022-26747 | unspecified – < 13.4 | This issue was addressed with improved checks. This issue is fixed in Xcode 13.4. An app may be able to gain elevated privileges. | HIGH 7.8 | 0.6 % | ||
| CVE-2022-22607 | unspecified – < 13.3 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may | HIGH 7.8 | 0.9 % | ||
| CVE-2022-22605 | unspecified – < 13.3 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may | HIGH 7.8 | 0.8 % | ||
| CVE-2022-22608 | unspecified – < 13.3 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may | HIGH 7.8 | 0.9 % | ||
| CVE-2022-22603 | unspecified – < 13.3 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may | HIGH 7.8 | 1.0 % | ||
| CVE-2022-22606 | unspecified – < 13.3 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may | HIGH 7.8 | 1.0 % | ||
| CVE-2022-22601 | unspecified – < 13.3 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may | HIGH 7.8 | 1.0 % | ||
| CVE-2022-22602 | unspecified – < 13.3 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may | HIGH 7.8 | 1.0 % | ||
| CVE-2022-22604 | unspecified – < 13.3 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may | HIGH 7.8 | 1.0 % | ||
| CVE-2021-1800 | unspecified – < 12.4 | A path handling issue was addressed with improved validation. This issue is fixed in Xcode 12.4. A malicious application may be able to acce | MEDIUM 5.5 | 0.7 % | ||
| CVE-2019-8840 | unspecified – < 11.3 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 11.3. Compiling with untrusted sources may l | HIGH 8.8 | 1.3 % | ||
| CVE-2020-9992 | unspecified – < Xcode 12.0 | This issue was addressed by encrypting communications over the network to devices running iOS 14, iPadOS 14, tvOS 14, and watchOS 7. This is | HIGH 7.8 | 3.0 % | ||
| CVE-2019-8806 | unspecified – < Xcode 11.2 | A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file m | HIGH 7.8 | 1.0 % | ||
| CVE-2019-8800 | unspecified – < Xcode 11.2 | A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file m | HIGH 7.8 | 1.0 % | ||
| CVE-2019-8739 | unspecified – < Xcode 11.0 | A memory corruption issue was addressed with improved state management. This issue is fixed in Xcode 11.0. Processing a maliciously crafted | HIGH 7.8 | 1.0 % | ||
| CVE-2019-8724 | unspecified – < Xcode 11.0 | Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compili | HIGH 8.8 | 1.9 % | ||
| CVE-2019-8723 | unspecified – < Xcode 11.0 | Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compili | HIGH 8.8 | 1.9 % | ||
| CVE-2019-8722 | unspecified – < Xcode 11.0 | Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compili | HIGH 8.8 | 1.8 % | ||
| CVE-2019-8721 | unspecified – < Xcode 11.0 | Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compili | HIGH 8.8 | 1.8 % | ||
| CVE-2019-8738 | unspecified – < Xcode 11.0 | A memory corruption issue was addressed with improved state management. This issue is fixed in Xcode 11.0. Processing a maliciously crafted | HIGH 7.8 | 1.0 % |