Xcode 26.4 Security Update

What Xcode 26.4 Fixes

Xcode 26.4, released March 24, 2026, fixes 2 vulnerabilities in 2 parts of the system, according to Apple's security advisory.

Apple does not say that any of them were exploited before the fix. That makes Xcode 26.4 a routine security update: worth installing soon, not an emergency.

It has since been superseded: the newest security release for Xcode is Xcode 27.2, from October 29, 2026, which includes these fixes.

Grouped by us from the impact Apple gives for each fix; the impact lines below are Apple's own.

Which Devices Get Xcode 26.4

Apple lists Xcode 26.4 for: macOS Tahoe 26.2 and later.

How to Install Xcode 26.4

Xcode updates come from the Mac App Store, or as a download from Apple's developer website for anyone who keeps more than one version installed.

Security fixes are cumulative: any later release for the same version includes these as well, so if you are already past Xcode 26.4 there is nothing to do.

Every Fix in Xcode 26.4

All 2 CVEs in Apple's advisory, the most serious kinds first. Each entry is the part of the system affected, Apple's description of the impact and the fix, and the CVE ID.

• Simulator

  An app may be able to read arbitrary files as root

  A permissions issue was addressed with additional restrictions.

  CVE-2026-28889

• otool

  An app may be able to cause unexpected system termination

  An out-of-bounds read was addressed with improved bounds checking.

  CVE-2026-28890

Xcode Security Release History

Xcode 26.4 in context: the security releases Apple has published for Xcode, newest first, with the number of fixes each carried.

Frequently Asked Questions