Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Canva | Canva | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 18 Nov 2025 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 18 Nov 2025 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Canva
Canva canva |
|
| CPEs | cpe:2.3:a:canva:canva:*:*:*:*:*:macos:*:* | |
| Vendors & Products |
Canva
Canva canva |
Tue, 18 Nov 2025 00:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime. A local threat actor with unprivileged access could execute arbitrary code that inherits the TCC (Transparency, Consent, and Control) permissions assigned to Canva. | |
| Weaknesses | CWE-276 | |
| CPEs | ccpe:2.3:a:canva:canva:*:*:*:*:*:macos:*:* | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Bugcrowd
Published:
Updated: 2025-11-18T16:35:38.443Z
Reserved: 2025-11-06T07:17:33.346Z
Link: CVE-2025-12792
Vulnrichment
Updated: 2025-11-18T14:25:12.301Z
NVD
Status : Deferred
Published: 2025-11-18T01:15:44.287
Modified: 2026-04-15T00:35:42.020
Link: CVE-2025-12792
Redhat
No data.
OpenCVE Enrichment
No data.