Link following in Canon PIXUS iX6800 Series CUPS Printer Driver for macOS
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Improper handling of symbolic links in the installer of CUPS Printer Driver for macOS(*) may allow a local attacker with login privileges to exploit a specially crafted symbolic link during installation to modify permissions of directories for which they would not normally have authorization. *:Canon PIXUS iX6800 Series CUPS Printer Driver for macOS Version 16.91.0.0 or earlier (Japan) Canon PIXMA MG2500 Series and iX6800 Series CUPS Printer Driver for macOS Version 16.91.0.0 or earlier (US and Europe)
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Canon Inc. | Canon PIXUS iX6800 Series CUPS Printer Driver for macOS | up to 16.91.0.0 | — | No fix listed | CNA |
| Canon Inc. | PIXMA MG2500 Series CUPS Printer Driver for macOS | up to 16.91.0.0 | — | No fix listed | CNA |
| Canon Inc. | PIXMA iX6800 Series CUPS Printer Driver for macOS | up to 16.91.0.0 | — | No fix listed | CNA |
- Canon PIXUS iX6800 Series CUPS Printer Driver for macOS VendorCanon Inc. Affected up to 16.91.0.0 Fixed in — No fix listed CNA
- PIXMA MG2500 Series CUPS Printer Driver for macOS VendorCanon Inc. Affected up to 16.91.0.0 Fixed in — No fix listed CNA
- PIXMA iX6800 Series CUPS Printer Driver for macOS VendorCanon Inc. Affected up to 16.91.0.0 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-6892
- 2026-10-03 Alias added: GHSA-xjvf-w7h7-789h
References
Advisory 4
- https://psirt.canon/advisory-information/cp2026-004/
- https://canon.jp/support/support-info/260528-1vulnerability-response
- https://www.usa.canon.com/support/canon-product-advisories/CPA2026-004-Vulnerability-Remediation-for-My-Image-Garden-for-macOS-and-CUPS-Printer-Driver-for-macOS
- https://www.canon-europe.com/support/product-security/
More Canon Inc. vulnerabilities
- TI-2006-01145 Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote… CVSS 2.0HIGH 7.5
- TI-2006-01147 Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary… CVSS 2.0HIGH 7.5
- TI-2023-05725 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 3.1CRITICAL 9.8
- TI-2025-01879 Out-of-bounds write in Canon Inc. Satera MF656Cdw CVSS 3.1CRITICAL 9.8
- TI-2024-11734 Out-of-bounds write in Canon Inc. Satera MF656Cdw CVSS 3.1CRITICAL 9.8
- TI-2024-11733 Out-of-bounds write in Canon Inc. Satera MF656Cdw CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-6892 · CVE Program
- CVE-2026-6892 · NVD
- FIRST EPSS
- GHSA-xjvf-w7h7-789h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences