Executive brief
iOS, iPadOS, and macOS devices allow users to extract files from archives (like ZIP files). A flaw in path validation during this extraction process could permit an attacker to write arbitrary files to the system by crafting a malicious archive. An attacker could potentially overwrite critical system or application files, leading to device compromise or application malfunction.
Technical details
This is a path traversal vulnerability in archive extraction functionality affecting Apple's operating systems. The vulnerable component fails to properly validate and sanitize file paths when extracting files from archives, allowing path traversal sequences (e.g., "../") to escape intended extraction directories. An attacker would need to deliver a maliciously crafted archive file to the victim and have the user extract it—this requires local access and user interaction. Successful exploitation allows arbitrary file write to the filesystem, potentially enabling code execution or system compromise. The vulnerability was patched on September 14, 2026 in iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.
Affected products
- Apple iOS before iOS 27, before iOS 26.7
- Apple iPadOS before iPadOS 27, before iPadOS 26.7
- Apple macOS Golden Gate before 27
- Apple macOS Sequoia before 15.8
- Apple macOS Tahoe before 26.7
- Apple visionOS before 27
Timeline
- 2026-09-14: disclosed: CVE-2026-84534 published and patches released
- 2026-09-14: patched: Fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27