Root file write via CUPS token replay

Local privilege escalation in Apple macOS CUPS lets local users gain root on Sonoma before 14.8.8, Sequoia before 15.7.8, and Tahoe before 26.6. The cupsd daemon forwards a privileged Local authentication token to an attacker-controlled printer URI, then accepts the replayed token and writes attacker-chosen print data to an attacker-chosen file path as root. An unprivileged local account can register printers and exploit the chain without user interaction; the demonstrated primitive is an arbitrary root file write rather than completed privilege escalation.