EUVD-2025-208795Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Despite the high CVSS score of 7.8, the real-world risk is moderate due to several mitigating factors from the attack vector analysis. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates local access is required with user interaction needed to open the malicious file, preventing remote automated attacks. No EPSS score is available to assess exploitation probability, and the vulnerability is not listed in CISA KEV, indicating no known active exploitation. The presence of tags like RCE and buffer overflow confirm the technical severity, but the lack of public exploits and requirement for user action significantly reduce immediate risk compared to remotely exploitable vulnerabilities. Organizations using Affinity should prioritize patching but this is not an emergency-level threat. |
| Exploit ScenarioDerived | An attacker crafts a malicious EMF file containing oversized data fields that trigger the out-of-bounds write when opened in Affinity. The victim receives this file via email or download and opens it in Affinity, causing memory corruption that the attacker leverages to execute arbitrary code with the user's privileges. No public proof-of-concept is currently available, but the low attack complexity suggests exploit development would be straightforward for skilled attackers with access to the vulnerability details. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
An out-of-bounds write vulnerability in Canva Affinity's EMF file processing allows attackers to achieve code execution by crafting malicious EMF (Enhanced Metafile) image files. The vulnerability affects Affinity version 3.0.1.3808 and requires user interaction to open the malicious file, but then grants full system compromise with high impact to confidentiality, integrity, and availability. No evidence of active exploitation or public proof-of-concept exists, and the local attack vector with user interaction requirement reduces immediate risk.
RemediationAI
Update Canva Affinity to the latest version beyond 3.0.1.3808 as recommended in the vendor advisory at https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62. Until patching is complete, implement user awareness training to avoid opening EMF files from untrusted sources, consider blocking EMF file types at email gateways and web proxies, and enable application sandboxing or virtualization for high-risk users who must process external graphics files. Full technical details are available in the Talos report at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2310.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Canva Affinity's EMF (Enhanced Metafile) file format parser, specifically affecting the product identified by CPE cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*. EMF is a Windows-based vector graphics format commonly used for printing and document embedding. The root cause is CWE-787 (Out-of-bounds Write), a memory corruption class where the application writes data beyond allocated buffer boundaries during EMF file parsing. This type of vulnerability typically occurs when file format parsers fail to properly validate input data sizes or field lengths, allowing attackers to overwrite adjacent memory regions with controlled data.
Know when Canva gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
An out‑of‑bounds write vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out‑of‑bounds write, potentially leading to code execution.
Executive ViewAI
CVE-2025-64301 poses a HIGH risk to organizations where users work with image files in Canva Affinity, as attackers can achieve complete system compromise through maliciously crafted EMF files. While active exploitation is not currently observed and user interaction is required to trigger the vulnerability, the absence of an available patch means affected systems remain exposed to potential compromise with full impact to data confidentiality, integrity, and system availability.
Disable EMF file handling in Canva Affinity where possible; block .emf file extensions at email gateways and web content filters; implement application whitelisting to restrict Affinity execution; restrict file access permissions to limit lateral movement if compromise occurs; segment Affinity user workstations from sensitive systems and data repositories; require users to request approval before opening files from untrusted sources; implement endpoint detection and response (EDR) monitoring on workstations running Affinity to detect post-exploitation activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Canva Affinity EMF Memory Corruption
View all 2Session hijacking in the Canva Android App before 2.376.0 lets an attacker-controlled web page interact with the Canva a
Session hijacking in the Canva Android App before version 2.376.0 arises from an unrestricted header-reflection flaw in
Unauthenticated configuration overwrite in the Ortto plugin for WordPress (versions before 1.0.25) lets a remote attacke
Opening an attacker-crafted Affinity document in Affinity by Canva versions prior to 3.3.0 can trigger a stack-based buf
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file processing functionality, al
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file handling functionality of Canva Affinity,
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, allow
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity,
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file handling that allows attacke
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file processing functionality, af
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity,
GitHub PoC
Exploit-DB