Apple Xcode Integer Underflow Flaw Lets Crafted Archives Leak Memory and Crash Builds
Researchers disclosed an integer underflow in Apple's Mach-O archive parser that lets crafted static libraries crash Xcode builds or leak process memory.
SecureLayer7 disclosed an integer underflow in the mach_o::Archive::Entry::name() function in Apple's open-source dyld project, reported to Apple Product Security on May 23, 2026, with no public patch after more than 90 days. Crafted static archives (.a files) cause the parser's unsigned index to wrap to SIZE_MAX, producing SIGSEGV crashes in the ld-prime linker, out-of-bounds reads that may print adjacent memory to stderr, or SIGABRT in libtool and ranlib. The modern parser is used by ld-prime, the default linker for arm64, arm64e, and x86_64 since Xcode 15, while legacy ld-classic is unaffected. Crafted archives need only be processed, creating supply-chain risk via vendored SDKs, binary dependencies, and CI pipelines.
- Bug sits in mach_o::Archive::Entry::name(), where an unsigned index trimming spaces wraps to SIZE_MAX and overreads.
- Affects ld-prime, default linker since Xcode 15, plus libtool and ranlib; legacy ld-classic is unaffected.
- Outcomes include SIGSEGV crashes, out-of-bounds reads printing adjacent memory, and SIGABRT from oversized std::string allocations.
- Crafted .a files only need processing, creating supply-chain risk via vendored SDKs, dependencies, and CI pipelines.
- SecureLayer7 reported to Apple on May 23, 2026; over 90 days passed without a public patch.
- Vendors
- Apple
- Organizations
- SecureLayer7
From the original article
3 min read at gbhackers.com
A recently disclosed integer-underflow vulnerability in Apple’s modern Mach-O archive parser could allow a malicious static library to crash Xcode build processes or expose process memory through build logs. This flaw affects the parser used by Apple’s newer linker, ld-prime, as well as related developer tools, including libtool, ranlib, and potentially dyld_info. Apple Xcode Integer […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.