EUVD-2025-208799CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
Lifecycle Timeline
3Description
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
Analysis
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file handling that allows attackers to read memory beyond allocated buffer boundaries. The vulnerability affects Affinity version 3.0.1.3808 and potentially other versions in the product line. An attacker can craft a malicious EMF file that, when opened by a user, triggers the out-of-bounds read to disclose sensitive information from process memory, with a CVSS score of 6.1 indicating moderate severity with high confidentiality impact and limited availability impact.
Technical Context
The vulnerability resides in Canva Affinity's EMF (Enhanced Metafile) file parser, a legacy Windows graphics format used for document interchange. EMF is a vector graphics format that stores drawing instructions, and improper bounds checking during parsing of malformed EMF records can lead to reading beyond allocated memory buffers. The root cause is classified as CWE-125 (Out-of-bounds Read), a memory safety issue where the application fails to validate array/buffer indices before accessing memory. The affected product is identified via CPE as cpe:2.3:a:canva:affinity, and the Talos Intelligence report (TALOS-2025-2311) indicates the vulnerability was discovered during security research of the EMF parsing subsystem. This type of vulnerability commonly occurs in file format parsers when record length fields are not properly validated before being used as bounds for memory operations.
Affected Products
Canva Affinity version 3.0.1.3808 is confirmed affected according to the ENISA EUVD advisory (EUVD-2025-208799). The CPE cpe:2.3:a:canva:affinity indicates the broader Affinity product family is in scope, and given that only one specific version is named in the vulnerability sources, it is likely that multiple versions in the 3.0.x and potentially earlier release lines are affected, though Canva has not publicly documented a precise version range in the provided references. Users should consult Canva's official security advisory at https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62 and the Talos Intelligence report at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2311 for authoritative affected-version details and patch availability.
Remediation
Apply the security patch provided by Canva for Affinity; consult the official advisory at https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62 for specific version numbers and availability. Until patching is feasible, implement defensive measures such as disabling EMF file import/opening in Affinity if the feature is not essential, using sandboxed or virtualized instances for processing untrusted EMF files, and educating users to avoid opening EMF files from untrusted sources. Network-based mitigations are limited due to the local attack vector, but restricting file access to trusted repositories and monitoring for suspicious EMF file delivery can reduce exposure. Organizations relying on EMF interchange should prioritize patching and consider alternative vector formats (e.g., PDF, SVG) for cross-platform document sharing.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today