Loading vulnerability…
Arbitrary File Read as Root in Xcode Simulator
CVE-2026-28889 is a permissions issue in Simulator, fixed in Xcode 26.4, affecting systems running macOS Tahoe 26.2 and later. The flaw allowed an application to read arbitrary files with root privileges. Apple stated the issue was addressed by adding additional restrictions, indicating insufficient access control or privilege boundary enforcement within the affected Simulator component.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could allow an application to access arbitrary files as root, resulting in unauthorized disclosure of sensitive information stored on the host system. Depending on the files accessible, this could expose credentials, tokens, source code, configuration data, private keys, or other protected material normally restricted to privileged users.
If you can’t patch tonight, do this now.
Apply the vendor-provided Xcode 26.4 update on affected systems. If immediate patching is not possible, reduce exposure by limiting use of the affected Simulator component, restricting execution of untrusted applications in development environments, and minimizing access to sensitive files on systems where the vulnerable version is installed. Specific temporary mitigations beyond vendor patching are not currently available.
Patch, then assume compromise.
Upgrade to Xcode 26.4, which contains Apple's fix for the Simulator permissions issue. The vendor indicated the vulnerability was remediated through additional restrictions in the affected component.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.