Critical macOS CUPS Vulnerability (CVE-2026-39875) Exploited via Public PoC A proof-of-concept (PoC) exploit has been released for CVE-2026-39875, a high-severity macOS vulnerability in the Common UNIX Printing System (CUPS) that enables local privilege escalation via arbitrary file writes with root privileges. The flaw affects macOS Sonoma, Sequoia, and Tahoe versions prior to 14.8.8, 15.7.8, and 26.6, respectively. Discovered by security researcher Dallas Dubs, the exploit chains two logic flaws in the privileged `cupsd` daemon. An unprivileged local attacker can register a malicious printer, steal a valid CUPS authentication token during probing, and replay it to create a second printer with a `file://` device URI targeting an attacker-controlled path bypassing System Integrity Protection (SIP). The attack culminates in submitting a print job with controlled data, which `cupsd` writes to the specified location as root. The PoC, available on GitHub, confirms root-owned file creation but does not directly provide a full interactive shell. However, arbitrary file writes can facilitate privilege escalation by modifying sensitive files (e.g., configurations, scheduled tasks, or application support files), depending on system defenses. The exploit requires no user interaction and has been demonstrated on macOS Tahoe 26.4.1, Sequoia 15.7.5, and Sonoma 14.8.5. While the impact varies based on SIP restrictions and endpoint security controls, the vulnerability poses a significant risk to shared Mac systems, developer endpoints, and environments where untrusted local code execution is possible. Apple has patched the flaw in the latest macOS updates (26.6, 15.7.8, and 14.8.8). Security teams are advised to monitor for unusual printer registrations, suspicious print jobs targeting file-based destinations, and unexpected changes to printer device URIs as potential indicators of exploitation. The public PoC increases the likelihood of active testing and attacks, underscoring the urgency of patch deployment.