The vulnerability permits a maliciously crafted ZIP archive to bypass macOS Gatekeeper quarantine checks. Gatekeeper normally prevents unsigned or untrusted applications from running. Bypassing this mechanism allows an attacker to have the system treat the archive as safe and execute contained code, compromising system integrity and enabling arbitrary code execution without user awareness. This weakness is associated with CWE‑290 (Authorization Bypass) and CWE‑693 (Security Misconfiguration).

Vulnerable systems are macOS Sequoia and Sonoma. The issue is fixed in macOS Sequoia 15.7.8 and macOS Sonoma 14.8.8. Users operating earlier releases may be affected, including all builds prior to those patch releases. The advisory lists only the two major macOS versions, so all legacy releases before the stated patch versions are considered at risk.

The CVSS score is 5.5, reflecting moderate severity. The EPSS score is below 1%, indicating a low probability of exploitation, and the vulnerability is not listed in CISA KEV, meaning no widespread exploitation has been observed. Nonetheless, a malicious ZIP archive can still bypass Gatekeeper and allow execution of unwanted code if a user opens it, presenting an elevated risk to system integrity on non‑patched macOS systems.