3 CVEs found by XGPT were patched in macOS 27 release. CVE-2026-84536 — SMBClient: remote kernel memory corruption via integer underflow in symlink resolution Apple: "An integer underflow was addressed with improved input validation. Connecting to a malicious SMB server may lead to unexpected system termination." In smbfs_smb_unix_read_symlink(), nmlen -= 2 runs on a server-controlled size_t with no minimum check; a TRANS2 QUERY_PATH_INFO (SMB_QFILEINFO_UNIX_LINK) reply carrying fewer than 2 bytes wraps nmlen to SIZE_MAX, so targetlen = nmlen * 9 + 1 becomes 0xFFFFFFFFFFFFFFF8, the oversized kalloc_data returns NULL, and that unchecked buffer is immediately written through. What broadens the reachability is that the readlink is issued automatically from smbfs_vnop_getattr(), so ordinary directory enumeration — Finder, Spotlight, an indexer — exercises the path with no user action past connecting. CVE-2026-84537 — SMBClient: kernel heap corruption via allocation/free size mismatch Apple: "The issue was addressed with improved memory handling. An app may be able to cause unexpected system termination or corrupt kernel memory." nsmb_dev_ioctl reuses rwrq->ioc_cnt for both the kalloc_data size and the post-transfer byte count: a server answering SMBIOC_READ/SMBIOC_WRITE with a short transfer leaves the field reduced, and kfree_data releases the original allocation under the smaller size — a textbook zone-confusion primitive that current XNU hardening converts into termination. Apple treats the issue as an app-triggered local one even though the triggering bytes arrive over the network. CVE-2026-84581 — HFS: local kernel heap overflow in the extent B-tree byte-swap Apple: "A buffer overflow was addressed with improved bounds checking. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory." In hfs_swap_HFSPlusBTInternalNode, recordSize is sizeof(HFSPlusExtentDescriptor) (8 bytes) while the swap loop writes a full HFSPlusExtentRecord (64), so a 20-byte bounds check admits a 76-byte access — 52 bytes past the node buffer. The corruption is a SWAP_BE32 byte reversal of adjacent heap rather than attacker-chosen data, triggered by an unprivileged user mounting a crafted disk image and reading a file.
Post summary
The text confirms three CVEs were patched in the macOS 27 release with Apple advisories detailing the fixes, and provides extensive technical vulnerability mechanics, but contains no references to active exploitation, PoC code, or exploit tools.