EUVD-2025-208797CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
Lifecycle Timeline
3Description
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
Analysis
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, allowing an attacker to read memory beyond allocated buffer boundaries by supplying a specially crafted EMF file. Affected versions include Affinity 3.0.1.3808 and potentially other releases in the Affinity product line. Successful exploitation could disclose sensitive information from application memory, though the vulnerability does not enable code execution or denial of service; however, the local attack vector and user interaction requirement (opening a malicious file) limit real-world impact compared to network-exploitable vulnerabilities.
Technical Context
The vulnerability is classified as CWE-125 (Out-of-bounds Read), a memory safety issue arising from improper bounds checking in the EMF file parser within Canva Affinity. EMF is a vector graphics format commonly used in Windows environments for clipboard data and document embedding. The affected product is identified via CPE cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*, indicating the entire Affinity application suite is in scope. The root cause involves the parser failing to validate record length fields or array indices before dereferencing memory, allowing an attacker-controlled EMF file to specify offsets or sizes that exceed allocated heap or stack buffers, leading to information disclosure from adjacent memory regions.
Affected Products
Canva Affinity version 3.0.1.3808 is confirmed affected according to the EUVD advisory EUVD-2025-208797. The vulnerability likely affects other releases of Affinity across the 3.x branch; the wildcard in the CPE string (cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*) indicates all versions may be in scope pending vendor clarification. Canva's security advisory is available at https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62, and the Talos Intelligence report is available at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2300. Users should consult these references for the exact patch availability and version-to-version remediation guidance.
Remediation
Immediately update Canva Affinity to the patched version released by Canva; refer to the vendor security advisory at https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62 for the specific fixed version and download instructions. Until patching is completed, implement compensating controls: (1) avoid opening EMF files from untrusted sources, particularly those received via email or downloaded from the internet; (2) educate users on the risks of opening unusual or unsolicited EMF files in Affinity; (3) consider restricting Affinity usage to air-gapped or isolated environments if handling untrusted graphic content is unavoidable. No network-level mitigations are applicable given the local-only attack vector, but endpoint detection and response (EDR) tools configured to monitor for unusual memory access patterns or Affinity crashes may provide indirect detection capability.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today