The vulnerability is a logic flaw in macOS Tahoe’s file processing that allows a specially crafted ZIP archive to bypass Gatekeeper checks. This flaw is classified as CWE‑358, CWE‑693, indicating weaknesses in metadata handling and policy enforcement. By tricking the system into treating a malicious payload as a trusted application, an attacker could execute code without the user granting explicit permission. The issue stems from improper handling of ZIP metadata, which undermines the built‑in access control mechanism.

Apple macOS Tahoe versions older than 26.5. The fix was applied in macOS Tahoe 26.5 and later releases, so only installations of 26.4 or earlier are affected.

The EPSS score of <1% indicates a low likelihood of exploitation at this time, while the CVSS score of 5.5 places the vulnerability in the moderate severity range. The flaw is not listed in the CISA KEV catalog, yet it still permits malicious code execution if a user opens or extracts a crafted archive. The likely attack vector involves a user unintentionally handling a malicious ZIP file from email, cloud services, or downloads; this is inferred from the description of a ZIP archive bypassing Gatekeeper.