What is the CVSS score of CVE-2025-64733?

CVE-2025-64733 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Affinity are affected by CVE-2025-64733?

CVE-2025-64733 presents moderate security risk, a out-of-bounds read vulnerability rated CVSS 6.1. Exploitation could cause memory corruption or application crashes.

How to fix or mitigate CVE-2025-64733?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Affinity CVE-2025-64733

EUVD-2025-208797 MEDIUM

Out-of-bounds Read (CWE-125)

2026-03-17 talos

Buffer Overflow Information Disclosure Affinity

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 17, 2026 - 20:30 euvd

EUVD-2025-208797

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

CVE Published

Mar 17, 2026 - 18:52 nvd

MEDIUM 6.1

DescriptionCVE.org

An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.

AnalysisAI

An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, allowing an attacker to read memory beyond allocated buffer boundaries by supplying a specially crafted EMF file. Affected versions include Affinity 3.0.1.3808 and potentially other releases in the Affinity product line. Successful exploitation could disclose sensitive information from application memory, though the vulnerability does not enable code execution or denial of service; however, the local attack vector and user interaction requirement (opening a malicious file) limit real-world impact compared to network-exploitable vulnerabilities.

Technical ContextAI

The vulnerability is classified as CWE-125 (Out-of-bounds Read), a memory safety issue arising from improper bounds checking in the EMF file parser within Canva Affinity. EMF is a vector graphics format commonly used in Windows environments for clipboard data and document embedding. The affected product is identified via CPE cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*, indicating the entire Affinity application suite is in scope. The root cause involves the parser failing to validate record length fields or array indices before dereferencing memory, allowing an attacker-controlled EMF file to specify offsets or sizes that exceed allocated heap or stack buffers, leading to information disclosure from adjacent memory regions.

RemediationAI

Immediately update Canva Affinity to the patched version released by Canva; refer to the vendor security advisory at https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62 for the specific fixed version and download instructions. Until patching is completed, implement compensating controls: (1) avoid opening EMF files from untrusted sources, particularly those received via email or downloaded from the internet; (2) educate users on the risks of opening unusual or unsolicited EMF files in Affinity; (3) consider restricting Affinity usage to air-gapped or isolated environments if handling untrusted graphic content is unavoidable. No network-level mitigations are applicable given the local-only attack vector, but endpoint detection and response (EDR) tools configured to monitor for unusual memory access patterns or Affinity crashes may provide indirect detection capability.