macOS CUPS Flaw Lets Local Attackers Write Arbitrary Files as Root

A CUPS privilege vulnerability (CVE-2026-39875) in macOS Sonoma, Sequoia, and Tahoe allows a local attacker to register a malicious printer and combine token capture with a timing race to cause cupsd to write attacker-controlled content as root to arbitrary (non-SIP-protected) locations; a public PoC exists and Apple has released updates—organizations should patch, restrict local access, and monitor unexpected printer registrations and root-owned files.