CVE-2026-112602

LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

An authorization issue was addressed with improved state management. This issue is fixed in Xcode 27.2. An app may be able to access sensitive user data.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://support.apple.com/en-us/149589

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Referenced assets2 URLs

By indicator

Full discourse1 post

bWize@ishkme1d
Updated my Mac dev tools today: Command Line Tools 27.0 → 27.2. If you run full Xcode, get 27.2 (27B52). It fixes two security bugs: • CVE-2026-112605 (CoreDevice): bad symlink handling let an app read arbitrary files • CVE-2026-112602 (Instruments): an authorization bug let an app access sensitive user data Apple doesn't say they're being exploited, but shared and CI Macs that connect devices should update. Only have Command Line Tools? Those two components aren't in it, but you still get Swift 6.4.2: two optimizer miscompile fixes, an LLDB out-of-bounds write fix, and SwiftPM now checking each registry's cached download separately. Also new in Xcode 27.2: a JSON project format (.xcproj) that's easier for coding agents to edit. https://support.apple.com/en-us/149589 https://forums.swift.org/t/announcing-swift-6-4-2/90337
20010168
97 followersView on X

Explore more

Back to dashboard