CVE-2026-6892

Vulnerability

The Canon CUPS Printer Driver for macOS installer improperly validates symbolic links during installation [1]. Affected versions are Canon PIXUS iX6800 Series CUPS Printer Driver for macOS Version 16.91.0.0 or earlier (Japan) and Canon PIXMA MG2500 Series and iX6800 Series CUPS Printer Driver for macOS Version 16.91.0.0 or earlier (US and Europe). The flaw exists in the installer's handling of symlinks that can be manipulated by a local attacker with login privileges.

Exploitation

To exploit, an attacker must have local login access to the macOS system and create a specially crafted symbolic link pointing to a target directory for which they lack normal write permissions. When the legitimate user or administrator runs the affected printer driver installer, the installer follows the malicious symlink and applies permission changes to the attacker-specified directory instead of the intended installation location. No additional authentication or user interaction beyond running the installer is required [1].

Impact

Successful exploitation allows the attacker to modify the permissions of directories they would not normally be authorized to change. This could result in unauthorized access to sensitive files or further local privilege escalation, as the permission alteration may grant the attacker read, write, or execute rights on protected directories [1].

Mitigation

Canon has released updated macOS printer driver packages that correct the symlink validation issue. Users should download and install the latest drivers from the Canon software download page for their region. The fixed drivers are available as of the advisory publication date [1]. No workarounds have been documented, and this CVE is not listed on the Known Exploited Vulnerabilities (KEV) catalog.