{"id":"CVE-2026-86948","aliases":[],"cve":{"records":[{"id":"CVE-2026-86948","source":"apple","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-08T16:43:41.881Z","published":"2026-10-20T00:50:54.085Z","modified":"2026-10-30T20:00:48.125Z"}],"publishers":[{"name":"apple","role":"CNA","organizationId":"286789f9-fbc2-4510-9f9a-43facdede74c","modified":"2026-10-20T00:50:54.085Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-30T20:00:48.125Z"}],"references":[{"url":"https://support.apple.com/en-us/149040","tags":[],"source":"apple"}],"weaknesses":[{"id":"CWE-693","description":"CWE-693 Protection Mechanism Failure","source":"CISA-ADP"},{"id":"CWE-284","description":"CWE-284 Improper Access Control","source":"CISA-ADP"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-21T03:56:21.518896Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"This issue was addressed by enforcing library validation on the affected binaries.","titleSource":"apple","descriptionSource":"apple","description":"This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox.","score":7.8,"severity":"high","published":"2026-10-20T00:50:54.085Z","modified":"2026-10-30T20:00:48.125Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Apple","name":"Xcode","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"27","versionType":"custom"}],"cpes":[],"source":"apple","url":"https://www.cve.org/CVERecord?id=CVE-2026-86948"}],"remediation":[],"references":["https://support.apple.com/en-us/149040"],"sources":[{"name":"CVE","id":"CVE-2026-86948","modified":"2026-10-30T20:00:48.125Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-86948"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8}],"sourceAffected":[],"observedAt":"2026-10-30T20:24:14.654Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T16:30:35.111Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T21:10:40.390Z","attemptedAt":"2026-10-30T21:10:40.390Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T21:10:39.543Z","attemptedAt":"2026-10-30T21:10:39.543Z"},{"source":"EUVD","status":"refresh-failed","attemptedAt":"2026-10-30T21:10:36.425Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-30T21:10:38.077Z","attemptedAt":"2026-10-30T21:10:38.077Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-86948","url":"https://www.first.org/epss/","probability":0.0016,"percentile":0.05179,"date":"2026-10-30","checkedAt":"2026-10-30T21:10:38.077Z"},{"source":"GitHub Advisory Database","id":"GHSA-79mp-j3j2-g5p4","url":"https://github.com/advisories/GHSA-79mp-j3j2-g5p4","modified":"2026-10-29T18:31:42Z","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-10-30T21:10:39.543Z"},{"source":"NVD","id":"CVE-2026-86948","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86948","modified":"2026-10-30T20:17:21.660","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-10-30T21:10:40.390Z"},{"source":"NVD","id":"CVE-2026-86948","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86948","modified":"2026-10-30T20:17:21.660","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-30T21:10:40.390Z"}],"aiSummary":{"text":"Xcode before version 27 may allow an app to break out of its sandbox due to improper access control or protection mechanism failure. The issue is addressed by enforcing library validation. Local access is required.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T05:16:02.429Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-86948"}]}}