PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6892 Canon Inc. CVE debrief

A local privilege escalation vulnerability exists in Canon CUPS Printer Driver for macOS due to improper handling of symbolic links during installation. A local attacker with login privileges can exploit a specially crafted symbolic link to modify permissions of directories they would not normally be authorized to access. The vulnerability affects Canon PIXUS iX6800 Series CUPS Printer Driver for macOS Version 16.91.0.0 or earlier (Japan), and Canon PIXMA MG2500 Series and iX6800 Series CUPS Printer Driver for macOS Version 16.91.0.0 or earlier (US and Europe). The issue was published on 2026-05-29 and is currently awaiting analysis by NVD. No known exploitation in the wild or ransomware campaign use has been reported.

Vendor
Canon Inc.
Product
Canon PIXUS iX6800 Series CUPS Printer Driver for macOS
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-29
Original CVE updated
2026-05-29
Advisory published
2026-05-29
Advisory updated
2026-05-29

Who should care

macOS system administrators managing Canon printer deployments, security teams monitoring local privilege escalation vectors, and organizations with shared macOS workstations where users have standard login privileges but should not have directory permission modification capabilities.

Technical summary

The vulnerability stems from the installer's improper handling of symbolic links (CWE-59: Improper Link Resolution Before File Access). During installation, the installer follows symbolic links without adequate validation, allowing a local attacker to redirect file operations to arbitrary directories. By placing a specially crafted symbolic link in an expected installation path, the attacker can cause the installer to modify permissions of target directories outside the intended installation scope. This requires local login privileges and user interaction (running the installer), but enables modification of directory permissions that would normally be protected by authorization controls.

Defensive priority

medium

Recommended defensive actions

  • Apply vendor-provided updates for Canon CUPS Printer Driver for macOS when available
  • Restrict local user privileges on macOS systems where Canon printer drivers are installed
  • Monitor for unexpected permission changes in system directories following printer driver installations
  • Review Canon regional security advisories for patch availability and affected product versions
  • Consider application control policies to prevent unauthorized installer execution

Evidence notes

CVE description confirms improper symlink handling (CWE-59) in Canon macOS CUPS Printer Driver installer. CVSS 4.0 vector indicates local attack vector with low attack complexity, requiring low privileges and user interaction, with high integrity impact. Canon has published multiple regional advisories.

Official resources

2026-05-29T00:16:16.847Z