Canon EOS Webcam Utility Pro up to 2.3.29/2.3d on macOS permission assignment

Summaryinfo

A vulnerability was found in Canon EOS Webcam Utility Pro up to 2.3.29/2.3d on macOS. It has been rated as problematic. Affected is an unknown function. The manipulation leads to permission assignment. This vulnerability is uniquely identified as CVE-2025-5995. Local access is required to approach this attack. No exploit exists.

Detailsinfo

A vulnerability was found in Canon EOS Webcam Utility Pro up to 2.3.29/2.3d on macOS. It has been rated as problematic. This issue affects an unknown function. The manipulation with an unknown input leads to a permission assignment vulnerability. Using CWE to declare the problem leads to CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Canon EOS Webcam Utility Pro for MAC OS version 2.3d (2.3.29) and earlier contains an improper directory permissions vulnerability. Exploitation of this vulnerability requires administrator access by a malicious user. An attacker could modify the directory, potentially resulting in code execution and ultimately leading to privilege escalation.

The weakness was disclosed by Isaac Ordonez. It is possible to read the advisory at usa.canon.com. The identification of this vulnerability is CVE-2025-5995 since 06/11/2025. The exploitation is known to be easy. Attacking locally is a requirement. Additional levels of successful authentication are required for exploitation. The technical details are unknown and an exploit is not publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-19237). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Canon

Name

• EOS Webcam Utility Pro

Version

• 2.3.0
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7
• 2.3.8
• 2.3.9
• 2.3.10
• 2.3.11
• 2.3.12
• 2.3.13
• 2.3.14
• 2.3.15
• 2.3.16
• 2.3.17
• 2.3.18
• 2.3.19
• 2.3.20
• 2.3.21
• 2.3.22
• 2.3.23
• 2.3.24
• 2.3.25
• 2.3.26
• 2.3.27
• 2.3.28
• 2.3.29
• 2.3a
• 2.3b
• 2.3c
• 2.3d

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion