What is the CVSS score of CVE-2025-47873?

CVE-2025-47873 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Affinity are affected by CVE-2025-47873?

CVE-2025-47873 presents moderate security risk, a out-of-bounds read vulnerability rated CVSS 6.1. Exploitation could cause memory corruption or application crashes.

How to fix or mitigate CVE-2025-47873?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Affinity CVE-2025-47873

EUVD-2025-208783 MEDIUM

Out-of-bounds Read (CWE-125)

2026-03-17 talos

Information Disclosure Buffer Overflow Affinity

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 17, 2026 - 20:30 euvd

EUVD-2025-208783

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

CVE Published

Mar 17, 2026 - 18:52 nvd

MEDIUM 6.1

DescriptionCVE.org

An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.

AnalysisAI

An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file handling functionality, affecting Affinity version 3.0.1.3808 and potentially other versions. An attacker can craft a malicious EMF file that, when opened by a user in Affinity, triggers an out-of-bounds memory read, potentially disclosing sensitive information from process memory such as authentication tokens, cryptographic keys, or other confidential data. The vulnerability requires user interaction (opening a file) and local access, making it a moderate-priority issue with a CVSS base score of 6.1, though the high confidentiality impact warrants prompt patching.

Technical ContextAI

The vulnerability is rooted in improper bounds checking during EMF file parsing within Canva Affinity (CPE: cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*), classified under CWE-125 (Out-of-bounds Read). EMF is a vector graphics format commonly used in Microsoft Windows environments that contains complex record structures. The flaw occurs when Affinity processes specially crafted EMF records without validating that memory reads remain within allocated buffer boundaries. This allows an attacker-controlled file to reference invalid memory offsets, causing the application to read and potentially leak adjacent memory regions. The vulnerability is fundamentally a missing or inadequate bounds validation check in the EMF record deserialization logic.

RemediationAI

Users should upgrade Canva Affinity to a patched version released by Canva following the disclosure timeline; consult the Canva Trust Center advisory at https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62 and Talos report at https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2316 for the specific fixed version number. Until an official patch is available, users should avoid opening EMF files from untrusted sources and disable EMF file type handling in Affinity if the application supports it. System administrators can reduce attack surface by restricting user permissions to open files only from verified sources and implementing application whitelisting policies. For organizations that must continue using affected versions, isolate systems handling potentially malicious EMF files on restricted networks with minimal access to sensitive data.