CVE-2025-12792

Published: Nov 18, 2025Modified: Jun 17, 2026Deferred

3.2

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Exploitability: 1.5 / Impact: 1.4

Source: 4ac701fe-44e9-4bcd-9585-dd6449257611 (Secondary)

Description

The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor with unprivileged access could execute arbitrary code that inherits the TCC (Transparency, Consent, and Control) permissions assigned to Canva.

Related CWEs

CWE-276

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

References (1)

https://trust.canva.com/?tcuUid=1e77a34b-f586-450b-b30d-b6e17d15b443

Source: 4ac701fe-44e9-4bcd-9585-dd6449257611

Timeline

No history available yet.