The exploit targets a component used to run Apple's .dmg disk images files. The .dmg format is commonly used to compress programs for download and is similar to the .iso format used in Windows.
A security researcher using the initials 'LMH' posted details about the vulnerability as part of the Month of Kernel Bugs project.
The author claimed that the exploit could easily be executed in Apple's Safari web browser through a specially crafted .dmg file launched when a user visits a web page.
According to LMH, the threat can be mitigated in Safari by disabling a setting in the browser's preference panel that reads 'Open 'safe' files after downloading.'
Disabling the setting will prevent .dmg files, images, movies and PDF files from automatically opening after they have been downloaded.
Security firm Secunia rates the vulnerability as 'highly critical', its second-highest threat level. It is the highest alert level given to a Mac OS X vulnerability since the publication of an official Apple security update in early October.
The Month of Kernel Bugs project has vowed to post new proof-of-concept or exploit code every day for the entire month of November.
Apple did not respond to a request for comment.
- 'Macarena' virus hits Apple Mac OS X
- New Apple AirPort vulnerability surfaces
- Apple fixes random MacBook shutdowns
- Apple iPhone launch rumours grow
- Aircraft iPod connectors hit turbulence
Some parts of Atacama have not received rainfall for 500 years - but a sudden deluge of water upset the Desert's delicate biological balance
Spitzer Space Telescope could not spot Oumuamua, suggesting that it is actually pretty small
Greenland crater one of the 25 largest impact craters on Earth
This long-sought progenitor star was identified in an image captured by Hubble in 2007