Threat video1:00
CVE-2026-112602 Xcode Info Disclosure: Detection & IOCs
Apple fixed CVE-2026-112602 in Xcode 27.2, a local information-disclosure flaw. 9 detection rules, 11 IOCs and a free Splunk SPL rule.
Read the full threat intel for CVE-2026-112602 Xcode Info Disclosure: Detection & IOCs →
Chapters
- 0:00The hookApple patches two local disclosure flaws.
- 0:04The storyOctober: Apple released fixes for Xcode and macOS.
- 0:12Attack pathA malicious local app triggers the Instruments flaw.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromiseNo malicious indicators were published.
- 0:36MITRE ATT&CK techniques4 ATT&CK techniques, from execution to collection.
- 0:41Remediation1 step now: Apply macOS Tahoe 26.6 and Xcode 27.2 via auto-update.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Apple patches two local disclosure flaws.
0:05October: Apple released fixes for Xcode and macOS.
0:09No exploitation reported.
0:12A malicious local app triggers the Instruments flaw.
0:15It gains privilege elevation via CoreDevice symlink issue.
0:20Then accesses stored credentials.
0:22Exfiltrating system data.
0:27No threat actor is attributed. Confidence: low.
0:31No malicious indicators were published.
0:374 ATT&CK techniques, from execution to collection.
0:421 step now: Apply macOS Tahoe 26.6 and Xcode 27.2 via auto-update.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.