A memory-safety defect in the parser that Apple’s build toolchain uses to read static libraries can be triggered by a file that carries no executable code whatsoever.
Researchers at SecureLayer7 found an integer underflow in the Mach-O archive parser shipped inside Xcode. The routine trims trailing spaces from the 16-byte name field of an archive member, the layout static libraries use to package compiled object files. A member whose name is nothing but spaces drives the counter below zero, so it wraps and walks backward past the start of the field.
The parser then hands back a string whose pointer is valid but whose length sits near the maximum value. That poisoned length travels downstream into string construction and formatting, where it stops behaving like a length at all.
The firm demonstrated three outcomes from a small, data-only archive. One is a limited read past mapped memory that can surface inside build logs. Another is an allocation request large enough to abort compilation through an uncaught exception. A third proof of concept produced a further out-of-bounds read.
Ninety days without an answer
None of it needs user interaction, authentication or a bundled payload. The library only has to arrive as a build input, which is exactly how third-party archives reach a project. Disclosure terms allowed three months: the write-up reached Apple Product Security on May 23, 2026, no fix followed, and no word came back that one was on the way, so the technical detail went public once that window lapsed.
Build-chain bugs deserve attention because a malformed archive can stall a release pipeline or spill fragments of a developer’s memory into logs. It cannot execute by itself, but the tooling that trusts it is doing the running.
