Technical impact
The vulnerability is a logic flaw in macOS Tahoe’s file handling that has been addressed with improved handling, but older versions remain affected. A maliciously crafted ZIP archive may bypass Gatekeeper checks. The issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.5. The flaw is classified as CWE-358 and CWE-693, indicating weaknesses in metadata handling and policy enforcement. By tricking the system into treating a malicious payload as a trusted application, an attacker could execute code without the user granting explicit permission.
Affected Systems
Apple macOS Sequoia versions older than 15.7.8, macOS Sonoma versions older than 14.8.8, and macOS Tahoe versions older than 26.5. The fix was applied in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.5, so only installations of those earlier releases are impacted.
Risk and Exploitability
The EPSS score of <1% indicates a low likelihood of exploitation at this time, while the CVSS score of 5.5 places the vulnerability in the moderate severity range. The flaw is not listed in the CISA KEV catalog, yet it still permits malicious code execution if a user opens or extracts a crafted archive. The likely attack vector involves a user unintentionally handling a malicious ZIP file from email, cloud services, or downloads; this is inferred from the description of a ZIP archive bypassing Gatekeeper.
