CVE-2025-12792CWE-276

CVE-2025-12792

Low · published November 18, 2025

CVSS v3.1

3.2

EPSS

Percentile

2.1

In the wild

Unconfirmed

What it is

The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor with unprivileged access could execute arbitrary code that inherits the TCC (Transparency, Consent, and Control) permissions assigned to Canva.

The record

Technical detail

CVSS v3.1: 3.2 · LOW
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00125 · 2.1th percentile
Weakness: CWE-276 · Incorrect Default Permissions
Published: 2025-11-18T06:15Z

References (1)

https://trust.canva.com/?tcuUid=1e77a34b-f586-450b-b30d-b6e17d15b443 · 4ac701fe-44e9-4bcd-9585-dd6449257611

EPSS history

Timeline

18 NOV 00:18Z
The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime
cvelistv5