Xcode 26.1 Security Update

What Xcode 26.1 Fixes

Xcode 26.1, released November 3, 2025, fixes 2 vulnerabilities in 2 parts of the system, according to Apple's security advisory.

Apple does not say that any of them were exploited before the fix. That makes Xcode 26.1 a routine security update: worth installing soon, not an emergency.

It has since been superseded: the newest security release for Xcode is Xcode 27.2, from October 29, 2026, which includes these fixes.

Grouped by us from the impact Apple gives for each fix; the impact lines below are Apple's own.

Which Devices Get Xcode 26.1

Apple lists Xcode 26.1 for: macOS Sequoia 15.6 and later.

How to Install Xcode 26.1

Xcode updates come from the Mac App Store, or as a download from Apple's developer website for anyone who keeps more than one version installed.

Security fixes are cumulative: any later release for the same version includes these as well, so if you are already past Xcode 26.1 there is nothing to do.

Every Fix in Xcode 26.1

All 2 CVEs in Apple's advisory, the most serious kinds first. Each entry is the part of the system affected, Apple's description of the impact and the fix, and the CVE ID.

• lldb

  A user in a privileged network position may be able to cause a denial-of-service

  A buffer overflow was addressed with improved bounds checking.

  CVE-2025-43504

• GNU

  Processing a maliciously crafted file may lead to heap corruption

  An out-of-bounds write issue was addressed with improved input validation.

  CVE-2025-43505

Xcode Security Release History

Xcode 26.1 in context: the security releases Apple has published for Xcode, newest first, with the number of fixes each carried.

Frequently Asked Questions