EUVD-2025-208787CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
Lifecycle Timeline
3Description
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
Analysis
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality that allows attackers to read memory beyond allocated buffer boundaries. Canva Affinity version 3.0.1.3808 and potentially earlier versions are affected. An attacker can craft a malicious EMF file that, when opened by a user, triggers the out-of-bounds read to disclose sensitive information from process memory; the vulnerability requires user interaction (opening the file) but no elevated privileges, making it a practical attack vector for phishing or drive-by downloads.
Technical Context
The vulnerability resides in Canva Affinity's EMF (Enhanced Metafile) file parser, a vector graphics format commonly used in Windows environments. The root cause is classified under CWE-125 (Out-of-bounds Read), which occurs when the parser fails to properly validate EMF record lengths or structure boundaries before reading data into a fixed-size buffer. The affected product is identified by CPE cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*. EMF parsing is a complex operation involving interpretation of drawing commands, and improper bounds checking on record fields or resource tables can lead to reading beyond the intended buffer, exposing adjacent memory regions containing sensitive data such as encryption keys, authentication tokens, or other process secrets.
Affected Products
Canva Affinity version 3.0.1.3808 is explicitly confirmed as affected according to the EUVD advisory (EUVD-2025-208787). The CPE string cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:* indicates that the vulnerability may affect multiple versions of Canva Affinity, though the specific version range has not been fully disclosed in the provided sources. Users should consult the official Canva security advisory at https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62 and the Talos Intelligence vulnerability report at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2317 for a complete list of patched versions and affected releases.
Remediation
Users should upgrade Canva Affinity to the patched version as specified in the official Canva security advisory (https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62). Check the Canva support portal or release notes for the exact patched version number. Until a patch is deployed, implement the following workarounds: disable automatic opening of EMF files from untrusted sources, configure email clients to block or sandbox EMF attachments, and educate users not to open EMF files from unknown or suspicious senders. For enterprise environments, consider implementing application whitelisting or sandboxed preview tools for potentially malicious document formats. Monitor Talos Intelligence (https://talosintelligence.com/vulnerability_reports/TALOS-2025-2317) and the NIST National Vulnerability Database (https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2317) for updated guidance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today