Canva CVE-2025-61952

The CVSS 3.1 score of 6.1 reflects a medium-to-high risk with specific characteristics: the attack vector is local (AV:L), attack complexity is low (AC:L), no privileges are required (PR:N), but user interaction is required (UI:R). The primary impact is confidentiality (C:H—high), with minor availability impact (A:L) but no integrity impact (I:N). This profile indicates a moderate real-world risk: exploitation requires persuading a user to open a crafted file, which is a realistic social engineering scenario. The CVSS vector does not account for EPSS exploitation probability, POC availability, or KEV listing status based on provided data; however, the involvement of Talos Intelligence (Cisco's threat research division) and official advisories from Canva and NIST elevates credibility and suggests the vulnerability has been validated. The local attack vector and user-interaction requirement mitigate widespread automated exploitation, but the high confidentiality impact and ease of file distribution via email or web downloads make this a genuine priority for users of Affinity design tools, particularly those handling sensitive documents. This should be treated as a moderate-to-high priority fix due to information disclosure potential.

An attacker creates a malformed EMF file with crafted record structures that cause the parser to read beyond buffer boundaries and collects sensitive data from adjacent memory regions. The attacker distributes this file via email with a social engineering message (e.g., 'Please review this design mockup') or hosts it on a compromised website. When a Canva Affinity user opens the file, the out-of-bounds read silently exposes information such as API keys, session tokens, or other credentials from the Affinity process memory, which the attacker can exfiltrate through side-channel methods or infer from timing/behavior observations. No additional privileges or system interaction is required beyond the victim opening the file, making this a practical attack chain for targeted phishing campaigns.