Canva CVE-2025-61979

The CVSS 3.1 score of 6.1 (Medium severity) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L indicates a local attack vector requiring user interaction but no privileges, yielding high confidentiality impact with low availability impact and no integrity compromise. This profile is consistent with a memory disclosure vulnerability rather than code execution. The presence of an EUVD identifier (EUVD-2025-208789) and reporting from Talos Intelligence (a credible Cisco-operated threat intelligence division) elevates confidence in the vulnerability's legitimacy. However, without confirmed EPSS data, active exploitation reports, or public proof-of-concept code noted in available references, the real-world risk remains moderate—dependent on the prevalence of EMF file sharing to Affinity users and the sensitivity of data typically present in process memory during design operations. The user interaction requirement (opening a file) acts as a significant limiting factor compared to network-exploitable issues. This should be prioritized for patching but does not warrant emergency response protocols typical of critical RCE vulnerabilities.

An attacker crafts a malicious EMF file containing record structures with out-of-bounds offsets or sizes and distributes it to a target designer or content creator, either via email, file-sharing platform, or social engineering. When the target opens the file in Canva Affinity to review or edit it, the EMF parser reads beyond the intended buffer boundaries, exposing sensitive data resident in adjacent memory such as API credentials, project metadata, or encryption keys. The attacker then retrieves this leaked information through side-channel analysis or by embedding data exfiltration logic in subsequent interactions, potentially compromising downstream systems or services that rely on the leaked credentials.