A maliciously crafted ZIP archive can circumvent macOS Gatekeeper’s signed application verification, enabling unsigned or tampered software to run. Because Gatekeeper is a core security layer that enforces code signing before execution, the flaw erodes a fundamental defense and can let an attacker deploy malware that runs with the privileges of the user who opens the archive.

Apple macOS releases prior to Sequoia 15.7.8 and Sonoma 14.8.8 are vulnerable; installing those versions or later remediate the validation weakness.

The exploit requires the attacker to supply a malicious ZIP file and rely on a user or automated process to open it. The CVSS score of 5.5 indicates medium severity, while the EPSS score of less than 1% indicates a low global exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, Gatekeeper operates with elevated privileges as a core security layer, so the potential impact remains notable in environments where the feature is enabled and users frequently open archives.