Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "Xcode",
"vendor": "Apple",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Apple Product Security via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-03-24-2026-10 Xcode 26.4\n\nXcode 26.4 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/126801.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\notool\nAvailable for: macOS Tahoe 26.2 and later\nImpact: An app may be able to cause unexpected system termination\nDescription: An out-of-bounds read was addressed with improved bounds\nchecking.\nCVE-2026-28890: Nathaniel Oh (@calysteon)\n\nSimulator\nAvailable for: macOS Tahoe 26.2 and later\nImpact: An app may be able to read arbitrary files as root\nDescription: A permissions issue was addressed with additional\nrestrictions.\nCVE-2026-28889: Mihai Marin\n\nAdditional recognition\n\nDev Tools\nWe would like to acknowledge Nathaniel Oh (@calysteon) for their\nassistance.\n\notool\nWe would like to acknowledge Eddy T for their assistance.\n\nSwift\nWe would like to acknowledge Banavath Aravind for their assistance.\n\nXcode 26.4 may be obtained from:\n\nhttps://developer.apple.com/xcode/downloads/\n\nTo check that the Xcode has been updated:\n\n* Select Xcode in the menu bar\n* Select About Xcode\n* The version after applying this update will be \"Xcode 26.4\".\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple's Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmnDI48ACgkQ4Ifiq8DH\n7PUtRg/+K3DU37tAHl9h/wfU7fO6J/I8YhzMGU6tcLK4b/9UG/16/qOwIUVLd9ML\nmCrEQY3hevwMyA+ki0HRmE0aiNTtGiFlpxNxhsyo3p6QDMXR4xyPjyFFdOcjUfKI\nkDHTg0NoCZWi63+hpGHhP3emCAr9/rDnOwtbUDrl57UaCc05HPydZ40ggNxz9S2/\nwh6ZrXPKlQHDBYQcmRV1TkqcdpyCJqNNIG2N+SBH489easlDXfQf5AS1Go3otDbU\nMwviuKhN4DDPbcV+SXVJjJR/NQzmWFO5RuFvjkFTh/Z7Xi9HQY1Ytkekwl/LfNDw\nOdC1aMu7CxKe4ZmC3fcOEOoriVDXVqORm3fmu1h5e9q/aJgJJy/0Rsu6hvec0yqJ\nSJOv+oVAlQalZF23XYDm71vM0GdFS6jXkjAcDyeUIgK4a1xSNCln0fH/TEW4V+2f\nplLWU8xirJ2vB+DO8+E6+Kg9WYDr63a8Tr0sNV0J42SwSbk3FLvsStEIgFIcm6HI\n9SOyFWp3Jc8bFBmuOjiXFn9IBtkX6FT6TSWdDCIisdeilIcXHLRNa6Iljzn2kGqP\nLmdGIbsSlggvy9thXIQ/t0ri2CL22aV6vV1Qjl1UW/i/vTtBA75ydroiyUhvo+If\ndbSuto6QwxoTbULDd+lyHgRmJ4irQcOsJerFDI0k7Ju03n0hvdQ=\n=YITA\n-----END PGP SIGNATURE-----\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T11:21:58Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/25"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Mar/25"
},
{
"url": "https://developer.apple.com/xcode/downloads/"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.apple.com/100100"
},
{
"url": "https://support.apple.com/126801"
},
{
"url": "https://www.apple.com/support/security/pgp/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Mar/25"
],
"discovery": "EXTERNAL"
},
"title": "APPLE-SA-03-24-2026-10 Xcode 26.4",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-28889",
"type": "related"
},
{
"destId": "CVE-2026-28890",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0270",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/25",
"automated": true,
"contentSha256": "21d0f7f48fa4cc7406405781627c0cb071ada2d9732289b5217227cb7b51bacf",
"evidenceScore": 6,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/25",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-03-25T00:06:07Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:43Z",
"dateUpdated": "2026-09-11T11:21:58Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0270"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}