{"id":"CVE-2026-112672","kind":"vulnerability","aliases":["CVE-2026-112672"],"related":[],"title":"macOS: crafted ZIP archive can bypass Gatekeeper checks","description":"The issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A maliciously crafted ZIP archive may bypass Gatekeeper checks.","summary":"A maliciously crafted ZIP archive can get past Gatekeeper's checks on macOS. An attacker who gets a user to open such an archive can run software that Gatekeeper would otherwise block.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["endpoints","infrastructure","macos"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe), as named in the advisory description","status":"open","published_at":"2026-10-26T21:18:00+00:00","first_seen_at":"2026-10-26T21:20:29+00:00","triaged_at":"2026-10-26T21:23:40+00:00","updated_at":"2026-10-26T21:23:40+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-26T21:23:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update macOS to `27.2` (Golden Gate), `15.8.2` (Sequoia), or `26.7.2` (Tahoe), as named in the advisory description","reach":"local","title":"macOS: crafted ZIP archive can bypass Gatekeeper checks","impact":"medium","summary":"A maliciously crafted ZIP archive can get past Gatekeeper's checks on macOS. An attacker who gets a user to open such an archive can run software that Gatekeeper would otherwise block.","category":"infrastructure","nicknames":[],"who_cares":["macos","endpoints"],"confidence":0.5,"needs_auth":"no","worst_case":"Gatekeeper blocked software runs from a crafted archive","analyst_note":"Check Apple's security release notes for CVE-2026-112672 for affected version ranges and the exact fixed builds; the NVD entry has no severity.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Macs running macOS versions earlier than the fixed releases named in the description. The sources do not say which earlier builds are affected in detail. Managed fleets that rely on Gatekeeper for downloaded files are the most exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00056,"input_tokens":3277,"output_tokens":464,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112672':11A,14A '-2026':10A,13A '15.8.2':68C '26.7.2':71C '27.2':65C 'address':53C 'archiv':4A,22B,41B,76C 'attack':32B 'block':49B 'bypass':6A,78C 'check':8A,28B,56C,80C 'craft':2A,20B,74C 'cve':9A,12A 'endpoint':15B 'fix':60C 'gate':64C 'gatekeep':7A,26B,46B,79C 'get':24B,34B 'golden':63C 'improv':55C 'infrastructur':16B 'issu':51C,58C 'maco':1A,17B,30B,62C,66C,69C 'malici':19B,73C 'may':77C 'open':38B 'otherwis':48B 'past':25B 'run':43B 'sequoia':67C 'softwar':44B 'taho':70C 'user':36B 'would':47B 'zip':3A,21B,75C","nicknames":[],"mitigations":[],"who_affected":"Macs running macOS versions earlier than the fixed releases named in the description. The sources do not say which earlier builds are affected in detail. Managed fleets that rely on Gatekeeper for downloaded files are the most exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T21:18:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112672","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112672","severity":null,"published_at":"2026-10-26T21:18:00+00:00","modified_at":"2026-10-26T21:18:00+00:00","first_seen_at":"2026-10-26T21:20:29+00:00","fetched_at":"2026-10-26T21:20:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}