CVE-2026-86949
High · 8.8CVSS
8.8
EPSS
0.2%
Published
Oct 20, 2026
CISA due date
—
The record
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63184 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-829
- CVE-2026-118762 Monkeytype is a minimalistic and customizable typing test. CWE-829
- CVE-2023-7357 A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher… CWE-829
- CVE-2026-15564 Wildfly's IIOP listener may permit deserialization of input streams before authentication… CWE-829
- CVE-2026-114488 A flaw was found in Wildfly. CWE-829
- CVE-2026-84725 when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR… CWE-829
- CVE-2026-59172 Joker is a small Clojure interpreter, linter and formatter written in Go. CWE-829
- CVE-2026-59176 Functype is a family of TypeScript functional programming libraries. CWE-829