CVE-2026-6891 MEDIUM

CVE-2026-6891

Vendor Canon Inc.

Product My Image Garden for macOS

Weakness CWE-59

Published May 28, 2026

Last update May 29, 2026

View on NVD All CVEs

CVSS base score

5.0/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality None

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

Improper handling of symbolic links in the installer of My Image Garden for macOS Version 3.6.8 or earlier may allow a local attacker with login privileges to exploit a specially crafted symbolic link during installation to modify permissions of files for which they would not normally have authorization.

Key dates

02Disclosure timeline

May 28, 2026 CVE published

May 29, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-6891 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/59.html

Related vulnerabilities

04Related CVE

CVE-2024-5742 Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file CVE-2024-50404 Qsync Central CVE-2021-23177 CVE-2022-22262 ASUS Armoury Crate & Aura Creator Installer之ROG Live Service - Improper Link Resolution Before File Access CVE-2022-31250 keylime %post scriplet allows for privilege escalation from keylime user to root