EUVD-2025-208798CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
Lifecycle Timeline
3Description
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
Analysis
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file processing functionality, affecting Affinity 3.0.1.3808 and potentially other versions. An attacker can craft a malicious EMF file that, when opened by a user in Affinity, triggers an out-of-bounds memory read, allowing disclosure of sensitive information from adjacent memory regions. While the CVSS score of 6.1 indicates moderate severity with high confidentiality impact, actual exploitation requires user interaction (opening a file) and is limited to information disclosure without code execution capability.
Technical Context
The vulnerability resides in Canva Affinity's EMF file parser, a component responsible for reading and rendering Windows Enhanced Metafile format documents. EMF is a vector graphics format commonly used in Windows environments that contains structured records defining drawing commands. The root cause is classified under CWE-125 (Out-of-bounds Read), indicating insufficient bounds checking when parsing EMF record structures or bitmap data embedded within EMF files. The affected product is identified via CPE (cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*), confirming this affects the Canva Affinity application suite. When the parser processes a specially crafted EMF file with malformed record headers or oversized data sections, it fails to validate memory access boundaries, allowing reads beyond allocated buffer limits and exposing heap or stack memory contents.
Affected Products
Canva Affinity version 3.0.1.3808 is explicitly confirmed as vulnerable via EUVD-2025-208798. The CPE specification cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:* indicates that multiple versions of Affinity may be affected, though the specific version 3.0.1.3808 has been formally documented. Users are advised to check the Canva security advisory at https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62 for the complete list of affected versions and available patches. The Talos Intelligence report at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2312 provides additional technical context.
Remediation
Immediately upgrade Canva Affinity to the patched version specified in the vendor advisory at https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62. Check the Talos report (https://talosintelligence.com/vulnerability_reports/TALOS-2025-2312) for the exact patched version number. Until patching is completed, implement administrative controls by disabling EMF file handling if possible, or restrict user ability to open EMF files from untrusted sources (external emails, downloads, web applications). Educate users to avoid opening EMF files from unverified senders. For enterprise deployments, monitor application logs for EMF file processing errors that may indicate exploitation attempts. Consider file-type restrictions or sandboxing of Affinity for users who handle files from high-risk sources.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today