Executive brief
A security flaw in macOS could allow a malicious file to bypass Gatekeeper, the system's built-in security feature that verifies software before it runs. An attacker could use a specially crafted ZIP archive to trick the system into running untrusted software without the usual security warnings. This could lead to the installation of unauthorized applications or malware if a user is persuaded to open the malicious file.
Technical details
A logic issue existed in the way macOS handled certain file types, specifically within ZIP archives. By crafting a malicious ZIP file, an attacker could bypass Gatekeeper's security verification mechanisms, which are intended to ensure only trusted software is executed. This vulnerability is categorized as an improperly implemented security check (CWE-358) and a protection mechanism failure (CWE-693). Exploitation requires a user to download and attempt to open the malicious archive. Apple has addressed this issue by improving file handling logic in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.5.
Affected products
- Apple macOS Sequoia before 15.7.8
- Apple macOS Sonoma before 14.8.8
- Apple macOS Tahoe before 26.5
Timeline
- 2026-05-11: disclosed
- 2026-05-11: patched
- 2026-05-11: advisory