Public PoC Released for CUPS Vulnerability Allows Attackers to Gain Root Privileges

A public proof-of-concept (PoC) has been released for CVE-2026-39875, a macOS vulnerability in the Common UNIX Printing System (CUPS) that allows an unprivileged local user to perform arbitrary file writes with root privileges. The flaw affects macOS Sonoma, Sequoia, and Tahoe versions before macOS 14.8.8, 15.7.8, and 26.6.

The PoC, published by security researcher Dallas Dubs, demonstrates how two logic flaws in the privileged cupsd printing daemon can be chained.

Although the public code demonstrates a root-level arbitrary file write rather than a complete interactive root shell, such a capability can create a realistic path to local privilege escalation depending on the targeted file and system configuration.

The flaw allows a local attacker to register a malicious printer and steal a valid CUPS authentication token during printer probing.

PoC Released for CUPS Vulnerability

The attacker can then replay the captured token to register another printer. This printer uses a file:// device URI that targets an attacker-selected local path not protected by System Integrity Protection (SIP).

The issue is especially serious because CUPS may begin root-privileged file operations before the related authentication validation process has fully completed.

In the final stage, the attacker submits a print job containing controlled data to the malicious printer. The cupsd daemon writes the supplied content to the selected location as root.

According to the PoC documentation on GitHub, the attack requires no user interaction after execution. It can be reproduced on vulnerable macOS versions. The public repository includes demonstrations against macOS Tahoe 26.4.1, macOS Sequoia 15.7.5, and macOS Sonoma 14.8.5.

The developer also clarified that the released script verifies that a file was created with root ownership. It does not directly provide a full privilege escalation mechanism.

However, arbitrary root file writes are a high-impact primitive. An attacker who already has access to a standard local account could abuse this condition to alter configuration files handled insecurely, scheduled task definitions, application support files, or other writable locations.

The practical impact will vary depending on SIP restrictions, file permissions, endpoint security controls, and the availability of a suitable target to turn the write into persistent root-level code execution.

Apple has addressed the vulnerability in macOS 26.6, macOS 15.7.8, and macOS 14.8.8. Organizations should prioritize deploying these updates, particularly on shared Mac systems, developer endpoints, and devices where users can execute untrusted local software.

Security teams should also monitor for unusual local printer registrations, unexpected changes to printer device URIs, and suspicious print jobs targeting file-based destinations.

Restricting unnecessary printer administration access and monitoring CUPS-related activity can provide additional detection coverage while patches are rolled out. The PoC release increases the likelihood of active testing and attempted exploitation, making prompt patching essential.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.