CVE-2026-84534 Overview
CVE-2026-84534 is a path handling vulnerability in Apple operating systems that allows an attacker to write arbitrary files when a user extracts a maliciously crafted archive. The flaw is categorized as a Path Traversal issue [CWE-22] and affects iOS, iPadOS, macOS, and visionOS. Apple addressed the issue with improved validation of paths during archive extraction. Successful exploitation requires local access and user interaction, but a crafted archive can overwrite files outside the intended extraction directory. This can enable persistence, configuration tampering, or code execution depending on which files an attacker targets.
Critical Impact
Extracting a malicious archive can allow an attacker to write arbitrary files to locations outside the intended extraction directory, undermining file system integrity on affected Apple devices.
Affected Products
- Apple iOS and iPadOS (fixed in iOS 26.7/iPadOS 26.7 and iOS 27/iPadOS 27)
- Apple macOS (fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7)
- Apple visionOS (fixed in visionOS 27)
Discovery Timeline
- 2026-09-14 - CVE-2026-84534 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-84534
Vulnerability Analysis
The vulnerability resides in the archive extraction logic within affected Apple operating systems. When the extraction routine processes archive entries, it fails to properly validate path components inside the archive. An attacker who crafts an archive containing entries with traversal sequences or absolute paths can cause the extraction process to write files to arbitrary locations on the file system.
Because the write occurs with the privileges of the user performing the extraction, an attacker can target user-writable paths such as launch agent directories, shell configuration files, or application resource bundles. Overwriting these files can lead to code execution when the user next launches an affected application or logs in.
Root Cause
The root cause is insufficient sanitization of file paths embedded within archive entries. The extractor did not adequately normalize or reject paths containing ../ sequences, absolute paths, or symbolic link targets that resolve outside the extraction destination. Apple corrected the flaw by adding improved path validation before writing extracted content to disk.
Attack Vector
Exploitation requires that a user open or extract a maliciously crafted archive delivered through email, messaging, web download, or removable media. The attack does not require elevated privileges but does require user interaction to trigger the extraction. Once triggered, the crafted archive writes files to attacker-chosen locations, breaking the integrity of the target file system without producing errors visible to the user.
No public proof-of-concept code has been published for CVE-2026-84534. See the Apple Support Document #149034 and related advisories for vendor technical details.
Detection Methods for CVE-2026-84534
Indicators of Compromise
- Files written outside the expected extraction directory after a user opens an archive, particularly in ~/Library/LaunchAgents, ~/.zshrc, ~/.bash_profile, or application bundle paths.
- Archive files (.zip, .tar, .gz) containing entries whose names include ../ sequences or absolute paths beginning with /.
- Unexpected modification timestamps on system configuration files immediately following archive extraction activity.
Detection Strategies
- Inspect archives at ingress with tools that enumerate archive entry names and flag traversal sequences before delivery to endpoints.
- Monitor endpoint file system events for writes performed by archive utilities such as Archive Utility.app, unzip, or tar that target paths outside the parent extraction directory.
- Correlate archive extraction events with subsequent process launches from newly written launch agents or shell startup files.
Monitoring Recommendations
- Enable file integrity monitoring on high-value directories including LaunchAgents, LaunchDaemons, and user shell profile locations.
- Log and retain endpoint telemetry for archive utility executions and the files they create.
- Alert on any archive extraction that produces writes spanning multiple parent directories in a single operation.
How to Mitigate CVE-2026-84534
Immediate Actions Required
- Update affected Apple devices to iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, or visionOS 27 as applicable.
- Instruct users to avoid opening archives received from untrusted senders or downloaded from untrusted web sources.
- Audit endpoints for archive extractions performed since the CVE was published and review any resulting file writes for suspicious locations.
Patch Information
Apple has released patches for all affected platforms. Refer to the vendor advisories for version-specific details: Apple Support Document #149034, #149035, #149038, #149041, #149042, and #149043.
Workarounds
- Extract untrusted archives inside an isolated user account or sandboxed environment that limits access to sensitive configuration paths.
- Use third-party archive utilities with strict path validation until the vendor patch can be applied.
- Restrict delivery of archive file types through email and web gateways where operationally feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.