This vulnerability (CVE-2026-6891) arises from improper link resolution before file access (CWE-59) in the installer of My Image Garden for macOS version 3.6.8 or earlier. A local attacker with login privileges can exploit a specially crafted symbolic link during installation to change permissions on files they should not be authorized to modify. The CVSS 3.1 base score is 5.0 (medium), reflecting local attack vector, low attack complexity, required privileges, and user interaction, with no impact on confidentiality or availability but a high impact on integrity.

The vulnerability allows a local attacker with login privileges to escalate their ability to modify file permissions on the system during installation of the affected software. This could lead to unauthorized changes to file permissions, potentially enabling further unauthorized actions. There is no impact on confidentiality or availability reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when installing or upgrading My Image Garden for macOS and restrict local user access where possible. Monitor Canon's official channels for updates regarding patches or workarounds.