CVE-2026-39875: Public PoC Lets a Malicious macOS App Gain Root Privileges

TL;DR

Apple has patched a macOS privilege escalation flaw tracked as CVE-2026-39875. A malicious app can chain two CUPS logic bugs to gain root. The researcher who reported it, Dallas Dubs, has already published full technical details and a working proof-of-concept exploit.

Why it matters

CUPS runs the printing system on every Mac. Because a public exploit now exists, the bar to abuse this bug has dropped sharply. Any unprivileged app on an unpatched machine can reach root. Root access means near-total control of the device.

How the attack works

The flaw lives in the privileged cupsd daemon, and it chains two logic errors. First, an unprivileged user registers a printer that points at a listener they control. cupsd then hands that listener a trusted authentication token it should never see. Next, the attacker replays the token to target a file path of their choosing. A final print job writes attacker-controlled content to that path as root. Notably, the chain needs no user interaction. The public write-up documents each step, which lowers the effort for others.

Affected versions

The bug affects macOS builds released before the late-July 2026 security updates. Apple rates it 7.8 on the CVSS scale. It credits Dallas Dubs alongside XBreach.ai, Aaron Grattafiori of the NVIDIA AI Red Team, and Nosebeard Labs.

Patch and mitigation

Update without delay. Apple fixed the macOS privilege escalation issue in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Because the proof-of-concept exploit is public, treat patching as urgent. So far, no in-the-wild exploitation has been confirmed.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.