CVE-20XX-?
agent?

Apple Xcode CVEs.

Published CVEs affecting Apple Xcode, ranked by exploit odds.

73 CVEs · updated 2026-11-06 20:33 UTC

  1. CVE-2004-2687

    distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.

    Drop everything Apple Xcode

    9.3 HIGH 87% exploit odds No fix listed
  2. CVE-2015-3184

    mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name.

    Apple Xcode

    5.0 MEDIUM 9% exploit odds Fix listed
  3. CVE-2020-9992

    This issue was addressed by encrypting communications over the network to devices running iOS 14, iPadOS 14, tvOS 14, and watchOS 7. This issue is fixed in iOS 14.0 and iPadOS 14.0, Xcode 12.0. An attacker in a privileged network position may be able to execute arbitrary code on a paired device during a debug session over the network.

    Apple Xcode

    7.8 HIGH 3% exploit odds Fix listed
  4. CVE-2018-4164

    An issue was discovered in certain Apple products. Xcode before 9.3 is affected. The issue, which is unspecified, involves the "LLVM" component.

    Apple Xcode

    9.8 CRITICAL 2% exploit odds Fix listed
  5. CVE-2006-1466

    Xcode Tools before 2.3 for Mac OS X 10.4, when running the WebObjects plugin, allows remote attackers to access or modify WebObjects projects through a network service.

    Apple Xcode

    4.0 MEDIUM 2% exploit odds No fix listed
  6. CVE-2015-5909

    IDE Xcode Server in Apple Xcode before 7.0 does not properly restrict access to repository e-mail lists, which allows remote attackers to obtain potentially sensitive build information in opportunistic circumstances by leveraging incorrect notification delivery.

    Apple Xcode

    5.0 MEDIUM 2% exploit odds Fix listed
  7. CVE-2019-8723

    Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.

    Apple Xcode

    8.8 HIGH 2% exploit odds Fix listed
  8. CVE-2019-8724

    Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.

    Apple Xcode

    8.8 HIGH 2% exploit odds Fix listed
  9. CVE-2019-8721

    Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.

    Apple Xcode

    8.8 HIGH 2% exploit odds Fix listed
  10. CVE-2019-8722

    Multiple issues in ld64 in the Xcode toolchains were addressed by updating to version ld64-507.4. This issue is fixed in Xcode 11.0. Compiling code without proper input validation could lead to arbitrary code execution with user privilege.

    Apple Xcode

    8.8 HIGH 2% exploit odds Fix listed
  11. CVE-2015-7030

    The Swift implementation in Apple Xcode before 7.1 mishandles type conversion, which has unspecified impact and attack vectors.

    Apple Xcode

    7.5 HIGH 2% exploit odds Fix listed
  12. CVE-2015-1149

    Integer overflow in the simulator in Swift in Apple Xcode before 6.3 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact by triggering an incorrect result of a type conversion.

    Apple Xcode

    7.5 HIGH 2% exploit odds Fix listed
  13. CVE-2017-7134

    An issue was discovered in certain Apple products. Xcode before 9 is affected. The issue involves the "ld64" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Mach-O file.

    Apple Xcode

    7.8 HIGH 2% exploit odds Fix listed
  14. CVE-2017-7135

    An issue was discovered in certain Apple products. Xcode before 9 is affected. The issue involves the "ld64" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Mach-O file.

    Apple Xcode

    7.8 HIGH 2% exploit odds Fix listed
  15. CVE-2017-7136

    An issue was discovered in certain Apple products. Xcode before 9 is affected. The issue involves the "ld64" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Mach-O file.

    Apple Xcode

    7.8 HIGH 2% exploit odds Fix listed
  16. CVE-2017-7137

    An issue was discovered in certain Apple products. Xcode before 9 is affected. The issue involves the "ld64" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Mach-O file.

    Apple Xcode

    7.8 HIGH 2% exploit odds Fix listed
  17. CVE-2008-2318

    The WOHyperlink implementation in WebObjects in Apple Xcode tools before 3.1 appends local session IDs to generated non-local URLs, which allows remote attackers to obtain potentially sensitive information by reading the requests for these URLs.

    Apple Xcode

    5.0 MEDIUM 1% exploit odds No fix listed
  18. CVE-2017-7167

    An issue was discovered in certain Apple products. Xcode before 9.2 is affected. The issue involves the "ld64" component. A buffer overflow allows remote attackers to execute arbitrary code via crafted source code.

    Apple Xcode

    7.8 HIGH 1% exploit odds Fix listed
  19. CVE-2019-8840

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 11.3. Compiling with untrusted sources may lead to arbitrary code execution with user privileges.

    Apple Xcode

    8.8 HIGH 1% exploit odds Fix listed
  20. CVE-2015-3027

    Clang in LLVM, as used in Apple Xcode before 6.3, performs incorrect register allocation in a way that triggers stack storage for stack cookie pointers, which might allow context-dependent attackers to bypass a stack-guard protection mechanism via crafted input to an affected C program.

    Apple Xcode

    5.0 MEDIUM 1% exploit odds Fix listed
  21. CVE-2015-7056

    IDE SCM in Apple Xcode before 7.2 does not recognize .gitignore files, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging the presence of a file matching an ignore pattern.

    Apple Xcode

    5.0 MEDIUM 1% exploit odds Fix listed
  22. CVE-2012-3698

    Apple Xcode before 4.4 does not properly compose a designated requirement (DR) during signing of programs that lack bundle identifiers, which allows remote attackers to read keychain entries via a crafted app, as demonstrated by the keychain entries of a (1) helper tool or (2) command-line tool.

    Apple Xcode

    5.0 MEDIUM 1% exploit odds Fix listed
  23. CVE-2022-22606

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.

    Apple Xcode

    7.8 HIGH 1% exploit odds Fix listed
  24. CVE-2019-8738

    A memory corruption issue was addressed with improved state management. This issue is fixed in Xcode 11.0. Processing a maliciously crafted file may lead to arbitrary code execution.

    Apple Xcode

    7.8 HIGH 1.0% exploit odds Fix listed
  25. CVE-2019-8739

    A memory corruption issue was addressed with improved state management. This issue is fixed in Xcode 11.0. Processing a maliciously crafted file may lead to arbitrary code execution.

    Apple Xcode

    7.8 HIGH 1.0% exploit odds Fix listed
  26. CVE-2019-8800

    A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution.

    Apple Xcode

    7.8 HIGH 1.0% exploit odds Fix listed
  27. CVE-2019-8806

    A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution.

    Apple Xcode

    7.8 HIGH 1.0% exploit odds Fix listed
  28. CVE-2022-22601

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.

    Apple Xcode

    7.8 HIGH 1.0% exploit odds Fix listed
  29. CVE-2022-22602

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.

    Apple Xcode

    7.8 HIGH 1.0% exploit odds Fix listed
  30. CVE-2022-22603

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.

    Apple Xcode

    7.8 HIGH 1.0% exploit odds Fix listed
  31. CVE-2022-22604

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.

    Apple Xcode

    7.8 HIGH 1.0% exploit odds Fix listed
  32. CVE-2018-4357

    A memory corruption issue was addressed with improved input validation. This issue affected versions prior to Xcode 10.

    Apple Xcode

    7.8 HIGH 0.9% exploit odds Fix listed
  33. CVE-2022-22607

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.

    Apple Xcode

    7.8 HIGH 0.9% exploit odds Fix listed
  34. CVE-2022-22608

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.

    Apple Xcode

    7.8 HIGH 0.9% exploit odds Fix listed
  35. CVE-2022-22605

    An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Xcode 13.3. Opening a maliciously crafted file may lead to unexpected application termination or arbitrary code execution.

    Apple Xcode

    7.8 HIGH 0.8% exploit odds Fix listed
  36. CVE-2015-5910

    IDE Xcode Server in Apple Xcode before 7.0 does not ensure that server traffic is encrypted, which allows remote attackers to obtain sensitive information by sniffing the network.

    Apple Xcode

    3.3 LOW 0.8% exploit odds Fix listed
  37. CVE-2021-1800

    A path handling issue was addressed with improved validation. This issue is fixed in Xcode 12.4. A malicious application may be able to access arbitrary files on the host device while running an app that uses on-demand resources with Xcode.

    Apple Xcode

    5.5 MEDIUM 0.7% exploit odds Fix listed
  38. CVE-2022-26747

    This issue was addressed with improved checks. This issue is fixed in Xcode 13.4. An app may be able to gain elevated privileges.

    Apple Xcode

    7.8 HIGH 0.6% exploit odds Fix listed
  39. CVE-2006-5327

    Untrusted search path vulnerability in OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local users to execute arbitrary code via a modified PATH that references a malicious gzip program, which is executed by gnutar with certain TAR_OPTIONS environment variable settings, when gnutar is invoked by OpenBase.

    Apple Xcode

    7.2 HIGH 0.6% exploit odds Fix listed
  40. CVE-2024-23298

    A logic issue was addressed with improved state management. This issue is fixed in Xcode 15.3. An app may bypass Gatekeeper checks.

    Apple Xcode

    5.5 MEDIUM 0.5% exploit odds Fix listed
  41. CVE-2024-40862

    A privacy issue was addressed by removing sensitive data. This issue is fixed in Xcode 16. An attacker may be able to determine the Apple ID of the owner of the computer.

    Disclosure Apple Xcode

    5.3 MEDIUM 0.5% exploit odds Fix listed
  42. CVE-2024-44228

    This issue was addressed with improved permissions checking. This issue is fixed in Xcode 16. An app may be able to inherit Xcode permissions and access user data.

    Auth & access Apple Xcode

    7.5 HIGH 0.4% exploit odds Fix listed
  43. CVE-2025-43504

    A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position may be able to cause a denial-of-service.

    Memory safety Apple Xcode

    4.9 MEDIUM 0.4% exploit odds Fix listed
  44. CVE-2016-4705

    otool in Apple Xcode before 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors, a different vulnerability than CVE-2016-4704.

    Apple Xcode

    7.8 HIGH 0.3% exploit odds Fix listed
  45. CVE-2025-43370

    A path handling issue was addressed with improved validation. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.

    Memory safety Apple Xcode

    4.0 MEDIUM 0.3% exploit odds Fix listed
  46. CVE-2025-43375

    The issue was addressed with improved checks. This issue is fixed in Xcode 26. Processing an overly large path value may crash a process.

    Denial of service Apple Xcode

    5.5 MEDIUM 0.3% exploit odds Fix listed
  47. CVE-2006-5328

    OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local users to create arbitrary files via a symlink attack on the simulation.sql file.

    Apple Xcode

    7.2 HIGH 0.3% exploit odds Fix listed
  48. CVE-2023-32396

    This issue was addressed with improved checks. This issue is fixed in Xcode 15, tvOS 17, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to gain elevated privileges.

    Apple Xcode

    7.8 HIGH 0.3% exploit odds Fix listed
  49. CVE-2016-1765

    otool in Apple Xcode before 7.3 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors.

    Apple Xcode

    7.8 HIGH 0.3% exploit odds Fix listed
  50. CVE-2023-40391

    The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, macOS Sonoma 14, Xcode 15. An app may be able to disclose kernel memory.

    Apple Xcode

    5.5 MEDIUM 0.3% exploit odds Fix listed

All CVEs affecting Apple Xcode that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.