A newly discovered memory-safety flaw in Apple’s modern Mach-O archive parser could potentially crash Xcode build tooling or cause limited memory disclosure through build logs This article explores memory disclosure build. . The issue affects the parser used by Apple’s newer linker, ld-prime, as well as libtool, ranlib, and potentially dyldinfo in current Xcode and Command Line Tools installations.
SecureLayer7 researchers reported the bug to Apple Product Security on May 23, 2026, but said more than 90 days elapsed without a patch or acknowledgment that the flaw would be addressed. A specially crafted archive member with an all-space name triggers the counter to go past zero, wrapping to SIZE_MAX and continuing to read backward beyond the field's beginning.
Instead of rejecting the malformed name, the routine returns a std::string_view with a valid pointer but a nearly maximum-sized length. The tool printed foreign bytes to standard error, creating a limited information-disclosure condition. Build systems frequently consume precompiled static libraries from various sources, including package registries, vendors, source repositories, and internal artifact stores.
The exposure is more prevalent in Apple's newer toolchain, which became the default linker path for arm64, arm64e, and x86_64 builds starting with Xcode 15. Organizations should take precautions by treating externally sourced static archives as untrusted build inputs: Pin and verify checksums for precompiled .a dependencies.
