Description
Improper handling of symbolic links in the installer of My Image Garden for macOS Version 3.6.8 or earlier may allow a local attacker with login privileges to exploit a specially crafted symbolic link during installation to modify permissions of files for which they would not normally have authorization.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Canon Inc. My Image Garden for macOS
Default version status: unaffected
3.6.8 or earlieraffected
References
- https://psirt.canon/advisory-information/cp2026-004/ ↗
- https://canon.jp/support/support-info/260528-2vulnerability-response ↗
- https://www.usa.canon.com/support/canon-product-advisories/CPA2026-004-Vulnerability-Remediation-for-My-Image-Garden-for-macOS-and-CUPS-Printer-Driver-for-macOS ↗
- https://www.canon-europe.com/support/product-security/ ↗