Xcode 27.2 Security Update

What Xcode 27.2 Fixes

Xcode 27.2, released October 29, 2026, fixes 2 vulnerabilities in 2 parts of the system, according to Apple's security advisory.

Apple does not say that any of them were exploited before the fix. That makes Xcode 27.2 a routine security update: worth installing soon, not an emergency.

It is the newest security release for Xcode on Apple's list.

Grouped by us from the impact Apple gives for each fix; the impact lines below are Apple's own.

Which Devices Get Xcode 27.2

Apple lists Xcode 27.2 for: macOS Tahoe 26.6 and later.

How to Install Xcode 27.2

Xcode updates come from the Mac App Store, or as a download from Apple's developer website for anyone who keeps more than one version installed.

Security fixes are cumulative: any later release for the same version includes these as well, so if you are already past Xcode 27.2 there is nothing to do.

Every Fix in Xcode 27.2

All 2 CVEs in Apple's advisory, the most serious kinds first. Each entry is the part of the system affected, Apple's description of the impact and the fix, and the CVE ID.

• CoreDevice

  An app may be able to read arbitrary files

  This issue was addressed with improved handling of symlinks.

  CVE-2026-112605

• Instruments

  An app may be able to access sensitive user data

  An authorization issue was addressed with improved state management.

  CVE-2026-112602

Xcode Security Release History

Xcode 27.2 in context: the security releases Apple has published for Xcode, newest first, with the number of fixes each carried.

Frequently Asked Questions