A newly discovered memory-safety vulnerability in Apple’s modern Mach-O archive parser could enable a malicious static library to crash Xcode build tools or expose limited memory information through build logs This article explores memory safety vulnerability. . The flaw affects the parser utilized by Apple’s newer linker, ld-prime, along with libtool, ranlib, and potentially dyldinfo in current Xcode and Command Line Tools installations.
SecureLayer7 researchers reported the bug to Apple Product Security on May 23, 2026, but noted that more than 90 days passed without a patch or acknowledgment that the flaw would be addressed. A specially crafted archive member with an all-space name field causes the counter to decrement past zero, wrapping to SIZE_MAX and continuing to read backward beyond the field's beginning.
The affected tools include ld-prime and ld asprintf, which can invoke strlen() on user-provided data, leading to a potential Segmentation Fault (SIGSEGV) when the data is manipulated by an attacker. Build systems typically pull precompiled static libraries from package registries, vendors, source repositories, and internal artifact stores. The exposure is more concentrated in Apple’s newer toolchain, which became the default linker path for arm64, arm64e, and x86_64 builds starting with Xcode 15.
Mitigations Organizations should treat externally sourced static archives as untrusted build inputs: Implement checksum verification for prebuilt .a dependencies. Isolate CI workers and restrict access to sensitive credentials and production resources.
