macOS Gatekeeper CVE-2026-28954

User must download and mount a specially crafted disk image (.dmg file) from an attacker-controlled or compromised source, typically delivered via web download, email attachment, or cloud file sharing. The bypass affects default macOS, iOS, and iPadOS configurations without requiring non-default settings, disabled security features, or administrative privileges. Exploitation is limited by requiring user action to download and open the DMG file (social engineering delivery), contradicting the CVSS UI:N metric - verify whether automated mounting scenarios exist. The vulnerability operates against Gatekeeper's quarantine mechanism regardless of whether the user has admin rights, as quarantine checks occur at file access time rather than requiring privilege escalation. Effectiveness depends on the disk image successfully evading additional malware scanning layers like XProtect antivirus signatures, meaning the bypass primarily defeats certificate verification and user warnings rather than all security controls.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N indicates network-accessible exploitation with low complexity and no authentication required, yet the UI:N (no user interaction) metric conflicts with the typical Gatekeeper bypass scenario requiring users to mount and open disk images. This discrepancy suggests either an automated exploitation vector not evident from the description or a potential CVSS scoring inconsistency - security teams should verify whether the bypass triggers without user action (e.g., auto-mounting) or requires clicking the DMG file. The EPSS score of 0.02% (5th percentile) indicates extremely low predicted exploitation probability despite the theoretical severity, likely reflecting that Gatekeeper bypasses require social engineering delivery and compete with simpler attack vectors. No CISA KEV listing or public exploit code identified at time of analysis. The confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N) appears misaligned with a code execution scenario, suggesting the CVSS may have been scored for information disclosure rather than the full bypass impact. Real-world priority should be moderate: patch during normal cycles for managed environments with email filtering and user awareness training, but prioritize for high-risk users (executives, researchers) who frequently handle external disk images.

An attacker crafts a malicious disk image containing malware and hosts it on a compromised legitimate website or distributes it via phishing email as a software update or document viewer. When a user downloads and opens the DMG file, the crafted disk image bypasses Gatekeeper's quarantine checks, mounting without the standard security warning that would normally appear for unverified software from the internet. The malicious application or payload inside executes without requiring the user to override security settings or approve an unverified developer, appearing to the user as if it were already trusted software. No public exploit code identified, but the low attack complexity (AC:L) suggests straightforward implementation once the bypass technique is understood.