Submit finding

All findings

CVE-2026-65355, CVE-2026-65415 high

Apple directly credits Xint Code on Private Relay and kernel flaws

Apple names Xint Code on an IP-address disclosure in Authentication Services and a kernel race exposing memory or causing a crash.

Bug class
Private Relay information disclosure and kernel race condition
Affected codebase
Apple Authentication Services and kernel
Credited system
Xint Code
Disclosed
September 14, 2026
Attribution
Direct source attribution
Severity
high
Source status: Apple directly names Xint Code on both CVEs. CVE-2026-65355 first appeared in the visionOS 26.6.1 notes; CVE-2026-65415 followed in macOS Golden Gate 27.

Summary

CVE-2026-65355 can reveal a user’s IP address despite Private Relay. Apple describes CVE-2026-65415 as a kernel race that lets a local attacker cause an unexpected termination or read kernel memory. Both reporter lines explicitly name Xint Code.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.