CVE-2025-12792
The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor with unprivileged access could execute arbitrary code that inherits the TCC (Transparency, Consent, and Control) permissions assigned to Canva.
- CVSS 3.1
- 3.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N - EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-25)
- CWE
- CWE-276
- Published
- Modified
- Record from
- the NVD, synced