Read the docs
TI-2024-14979 Aliases CVE-2024-22405

XADMaster may not apply quarantine attribute correctly to extracted files

Priority LOW 24CWE-281Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

XADMaster is an objective-C library for archive and file unarchiving and extraction. When extracting a specially crafted zip archive XADMaster may not apply quarantine attribute correctly. Such behaviour may circumvent Gatekeeper checks on the system. Only macOS installations are affected. This issue was fixed in XADMaster 1.10.8. It is recommended to upgrade to the latest version. There are no known workarounds for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Fix Fixed XADMaster (MacPaw): 1.10.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MacPawXADMasterbefore 1.10.81.10.8Patch availableCNA
  • XADMaster VendorMacPaw Affected before 1.10.8 Fixed in 1.10.8 Patch available CNA

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:macpaw:xadmaster:-:*:*:*:*:*:*:*not specified by CISA-ADP—MacPaw
  • cpe:2.3:a:macpaw:xadmaster:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·MacPaw

Remediation

  • Fix · CNA XADMaster (MacPaw) Fixed in 1.10.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22405

References

Other 2

  • TI-2019-03479 An exploitable privilege escalation vulnerability exists in the helper service CleanMyMac… CVSS 3.1MEDIUM 5.5
  • TI-2018-03015 Improper input validation in Clean My Mac CVSS 3.1MEDIUM 5.5
  • TI-2018-03014 Improper input validation in Clean My Mac CVSS 3.1MEDIUM 5.5
  • TI-2018-03013 Improper input validation in Clean My Mac CVSS 3.1MEDIUM 5.5
  • TI-2018-03012 Improper input validation in Clean My Mac CVSS 3.1MEDIUM 5.5
  • TI-2018-03011 Improper input validation in Clean My Mac CVSS 3.1MEDIUM 5.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences