VULNARCHIVE

GCVE-1988-2026-0400

APPLE-SA-09-14-2026-10 Xcode 27

Description (en)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-09-14-2026-10 Xcode 27

Xcode 27 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/149040.

Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.

Xcode IDE
Available for: macOS Tahoe 26.6 and later
Impact: An app may be able to access user-sensitive data
Description: A permissions issue was addressed with improved validation.
CVE-2026-65393: Mickey Jin (@patch1t)

Additional recognition

otool
We would like to acknowledge Eddy T for their assistance.

Swift
We would like to acknowledge Owais Lone (thesecguy), Yuval Fradkin for
their assistance.

tapi
We would like to acknowledge Jian Lee (@speedyfriend433) for their
assistance.

Xcode IDE
We would like to acknowledge Yiğit Can YILMAZ (@yilmazcanyigit) for
their assistance.

Xcode 27 may be obtained from:

https://developer.apple.com/xcode/downloads/

To check that the Xcode has been updated:

* Select Xcode in the menu bar 
* Select About Xcode 
* The version after applying this update will be "Xcode 27".

All information is also posted on the Apple Security Releases
web site: https://support.apple.com/100100.

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmqoZgMACgkQ4Ifiq8DH
7PVAMhAAj9ptC0BpUmk5jd55EREexCAl6SHEEeKE0aTwfSVShLoMOejlDgvTdldX
sUo89DfGvxug0FzpsUB7+EeqikVzPX/D3jxKzXO4u6bzL3eKA7vzZZfYoK4GHwdu
WdTus4bWiiKfkNbYTzezWoGOqMwnrQkXam5sCwmMSBQiXhfsN0nsqNyTBupOlRtZ
LQSHRJOfCS94uMAFZldieRWec+gR1kwbJM11nRHlAg4KT3BwsKZs3KJvrz6otbiQ
BRvKvttfLc1Z6mkrtNuZ0EmsZ933qkugtBFD7dulKLUVH+5UVtVXi2Tnc1Dg+RvC
qHVvyueuEqnzK5Pwr71j0jSSxsGgrnnaNWbZ0dI8zjOvWlvUm0HNru8fNtrl8q2Z
KmxI4MPrgCwnMP0SDXrX6ehRmT/FsXWP5D+Wr0Tc/RTDL5Bp8oDIQkqwKRpzGDBr
8WTsUsDmDOtd0cI4VltRPM38bDV7mLAqn7pzG+Bd6sUhgBfZx3dJjBamc0Famdkd
qH5DykKoiUc4VXNGq4ezm4n2aN1KGp17hEhQQArwVYhLcK9DIBBVCemkd8iYe71L
GSy+AE/IkGyi5Gd2jsL5qvk1you5OsQXyrqhsFeonfDMgJ7JXeVW4qxDHgf2NwiM
IRY/ZcOOda5lgxQCNfP+VJgqX1y2+URWXj2nKH8cr11vaPZ+Quw=
=NmyZ
-----END PGP SIGNATURE-----
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

References

Raw JSON
{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Xcode 27",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Apple Product Security via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-09-14-2026-10 Xcode 27\n\nXcode 27 addresses the following issues.\nInformation about the security content is also available at\nhttps://support.apple.com/149040.\n\nApple maintains a Security Releases page at\nhttps://support.apple.com/100100 which lists recent\nsoftware updates with security advisories.\n\nXcode IDE\nAvailable for: macOS Tahoe 26.6 and later\nImpact: An app may be able to access user-sensitive data\nDescription: A permissions issue was addressed with improved validation.\nCVE-2026-65393: Mickey Jin (@patch1t)\n\nAdditional recognition\n\notool\nWe would like to acknowledge Eddy T for their assistance.\n\nSwift\nWe would like to acknowledge Owais Lone (thesecguy), Yuval Fradkin for\ntheir assistance.\n\ntapi\nWe would like to acknowledge Jian Lee (@speedyfriend433) for their\nassistance.\n\nXcode IDE\nWe would like to acknowledge Yiğit Can YILMAZ (@yilmazcanyigit) for\ntheir assistance.\n\nXcode 27 may be obtained from:\n\nhttps://developer.apple.com/xcode/downloads/\n\nTo check that the Xcode has been updated:\n\n* Select Xcode in the menu bar \n* Select About Xcode \n* The version after applying this update will be \"Xcode 27\".\n\nAll information is also posted on the Apple Security Releases\nweb site: https://support.apple.com/100100.\n\nThis message is signed with Apple's Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCAAdFiEEhjkl+zMLNwFiCT1o4Ifiq8DH7PUFAmqoZgMACgkQ4Ifiq8DH\n7PVAMhAAj9ptC0BpUmk5jd55EREexCAl6SHEEeKE0aTwfSVShLoMOejlDgvTdldX\nsUo89DfGvxug0FzpsUB7+EeqikVzPX/D3jxKzXO4u6bzL3eKA7vzZZfYoK4GHwdu\nWdTus4bWiiKfkNbYTzezWoGOqMwnrQkXam5sCwmMSBQiXhfsN0nsqNyTBupOlRtZ\nLQSHRJOfCS94uMAFZldieRWec+gR1kwbJM11nRHlAg4KT3BwsKZs3KJvrz6otbiQ\nBRvKvttfLc1Z6mkrtNuZ0EmsZ933qkugtBFD7dulKLUVH+5UVtVXi2Tnc1Dg+RvC\nqHVvyueuEqnzK5Pwr71j0jSSxsGgrnnaNWbZ0dI8zjOvWlvUm0HNru8fNtrl8q2Z\nKmxI4MPrgCwnMP0SDXrX6ehRmT/FsXWP5D+Wr0Tc/RTDL5Bp8oDIQkqwKRpzGDBr\n8WTsUsDmDOtd0cI4VltRPM38bDV7mLAqn7pzG+Bd6sUhgBfZx3dJjBamc0Famdkd\nqH5DykKoiUc4VXNGq4ezm4n2aN1KGp17hEhQQArwVYhLcK9DIBBVCemkd8iYe71L\nGSy+AE/IkGyi5Gd2jsL5qvk1you5OsQXyrqhsFeonfDMgJ7JXeVW4qxDHgf2NwiM\nIRY/ZcOOda5lgxQCNfP+VJgqX1y2+URWXj2nKH8cr11vaPZ+Quw=\n=NmyZ\n-----END PGP SIGNATURE-----\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:32Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/62"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/62"
        },
        {
          "url": "https://developer.apple.com/xcode/downloads/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.apple.com/100100"
        },
        {
          "url": "https://support.apple.com/149040"
        },
        {
          "url": "https://www.apple.com/support/security/pgp/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/62"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "APPLE-SA-09-14-2026-10 Xcode 27",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-65393",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0400",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/62",
            "automated": true,
            "contentSha256": "b33704710406d524c5071dbc43269fcc65d6295abeb771a035668563c13117a5",
            "evidenceScore": 6,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/62",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-14T22:10:08Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:32Z",
    "dateUpdated": "2026-10-02T04:57:32Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0400"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}