A logic flaw in macOS file handling permits a maliciously crafted ZIP archive to bypass Gatekeeper checks, the operating system’s mechanism for ensuring only trusted applications run. The flaw enables an attacker to contain malicious code that can be executed on a user’s machine, effectively circumventing a core security barrier and providing a path to unauthorized code execution. The weakness originates from improper handling of ZIP metadata and falls under improper access control.

Apple macOS, specifically versions of macOS Tahoe prior to 26.5. The issue is resolved in macOS Tahoe 26.5 and later releases.

The EPSS score is not available, and this vulnerability is not listed in the CISA KEV catalog. While the exact CVSS score is not provided, the ability to bypass Gatekeeper suggests a high impact, especially if an attacker can supply a crafted ZIP to a user. The most likely attack vector involves a user opening or extracting a malicious ZIP file—either from email, file sharing, or downloads. Exploitation requires the victim to access the archive, so the risk is mitigated by user behavior but remains significant due to the critical role of Gatekeeper in the system’s security.