Loading vulnerability…
Out-of-bounds read in otool
CVE-2026-28890 is an out-of-bounds read vulnerability in otool, a component shipped with Xcode. The issue affects systems running macOS Tahoe 26.2 and later and was fixed in Xcode 26.4. Apple stated that the flaw was addressed through improved bounds checking. Successful triggering of the vulnerable condition by an application may lead to unexpected system termination, indicating a denial-of-service condition rather than direct code execution based on currently available information.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker-controlled or malicious application may be able to trigger an out-of-bounds read in otool and cause unexpected system termination. The documented impact is denial of service through a crash or abnormal termination of the affected system or related process. No evidence is currently available in the provided information to support confidentiality compromise, privilege escalation, or arbitrary code execution for this CVE.
If you can’t patch tonight, do this now.
Apply the vendor-provided Xcode 26.4 update as the primary mitigation. Until patching is completed, reduce exposure by limiting execution of untrusted applications and restricting access to development tooling on affected systems where feasible, since the available information indicates the issue can be triggered by an app.
Patch, then assume compromise.
Upgrade to Xcode 26.4, which fixes the vulnerability in otool by adding improved bounds checking. Ensure affected systems running macOS Tahoe 26.2 and later use the corrected Xcode release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.