CVE-2018-10406

CVE-2018-10406 describes a vulnerability in Yelp OSXCollector where a maliciously crafted Universal/fat binary can bypass third-party code signing verification. This allows an attacker to execute unsigned, malicious code while the tool incorrectly reports it as legitimately signed by Apple. With a CVSS score of 7.8 (High), this vulnerability has a local attack vector, low complexity, and high impact on confidentiality, integrity, and availability, requiring user interaction. There is no evidence of active exploitation, nor are there publicly available exploits in Metasploit or ExploitDB, though it has received some community discussion and media coverage.