An application can bypass the macOS Gatekeeper security mechanism, allowing unsigned or malicious software to execute without user consent. This logic error reduces the effectiveness of the built‑in protection against unverified code, potentially enabling an attacker to run arbitrary programs or elevate privileges. The flaw is categorized as a Protection Mechanism Failure (CWE‑693).

Apple macOS is affected, specifically all releases prior to macOS Tahoe 26.2. The update in Tahoe 26.2 fixes the underlying validation logic that enables the Gatekeeper bypass.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not currently listed in CISA’s KEV catalog, further implying limited known exploitation. The likely attack vector involves an attacker providing a crafted application that the user installs; once executed, the application can bypass Gatekeeper protections. Because Gatekeeper is a local system component, the attacker would need local access or convince a user to run the malicious app.