A developer tool update that landed two days after Apple’s main patch wave quietly closed two leaks, and one let any app on a Mac read files it had no business seeing. The advisory for Xcode 27.2 went up on October 29, a lone row below the release that shipped 329 platform fixes.
A symlink shortcut out of the sandbox
The first flaw sat in CoreDevice, the framework Xcode uses to talk to connected iPhones and iPads. A crafted symlink let an application reach arbitrary files on the host, tracked as CVE-2026-112605. Apple says the issue was fixed by handling symbolic links more carefully, which points at a link that steered the tool somewhere it should not have followed. Vladislav Shevchenko of Positive Technologies reported it.
The second bug lived in Instruments, the profiling tool bundled with the suite. An authorization problem let a program reach sensitive user data, logged as CVE-2026-112602. State management was reworked to close it, and Roelof van Dijk is credited. Neither entry carries an exploited-in-the-wild note, and neither appears in CISA’s registry of flaws under attack.
Why a toolchain bug matters more than it looks
Xcode runs with the permissions of a trusted human, on machines holding signing certificates, provisioning profiles and source for shipping apps. A read primitive inside those tools is worth more than the same bug in a consumer app, because the reachable files build and sign software other people install.
The fix requires macOS Tahoe 26.6 or later, so developers on Sequoia cannot take it. Updating through the App Store or developer downloads pulls the patched build; neither CVE has a workaround. No announcement accompanied the release, which is why it sat unnoticed beneath the larger October wave. Anyone who deferred the developer update still has both holes open.
