Submit finding

All findings

CVE-2026-39873, CVE-2026-84536, CVE-2026-84537 high

Apple adds three XGPT-attributed filesystem and SMB CVEs

Apple directly credits ThreatBook researchers using XGPT on three remote-crash or kernel-corruption vulnerabilities added in September.

Bug class
Integer underflow, memory corruption, and malicious-server denial of service
Affected codebase
Apple SMB and filesystem components
Credited system
ThreatBook XGPT
Disclosed
September 14, 2026
Attribution
Direct source attribution
Severity
high
Source status: Apple reporter lines explicitly name ThreatBook researchers using XGPT. CVE-2026-39873 was added to an earlier release page; the other two appear in macOS Golden Gate 27.

Summary

The three accepted findings cover a crash triggered by a malicious SMB server, an SMB integer underflow permitting a remote crash, and a memory-handling flaw that can corrupt kernel memory. Apple supplies both the fix trail and explicit XGPT credit.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.