Submit finding

All findings

CVE-2026-84581 high

Apple records shared XGPT and Bynario credit on an HFS buffer overflow

Apple credits a ThreatBook researcher using XGPT and Bynar.io on CVE-2026-84581, an HFS buffer overflow that can corrupt kernel memory.

Bug class
Buffer overflow and kernel-memory corruption
Affected codebase
Apple HFS
Credited system
ThreatBook XGPT
Also credited
BynarIO AI (self-reported)
Disclosed
September 14, 2026
Attribution
Direct source attribution
Severity
high
Source status: Apple directly names the XGPT-assisted researcher and Bynar.io on the same CVE. XGPT is direct system attribution; the mapping from the Bynar.io organization credit to BynarIO AI remains self-reported.

Summary

CVE-2026-84581 is an HFS buffer overflow that can let a local attacker corrupt kernel memory. The shared-credit representation preserves both discovery paths while the global counter counts the CVE once.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.