Canva CVE-2025-65119

This vulnerability presents moderate real-world risk with a CVSS v3.1 score of 6.1 (Medium severity). The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L) indicates local attack vector with low complexity, no privilege requirement, user interaction needed, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. The local-only attack vector significantly constrains exploit scenarios compared to network-based vulnerabilities, as an attacker must deliver the malicious EMF file to a victim's system and convince them to open it in Affinity. The presence of user interaction (UI:R) as a requirement further reduces exploitability probability. However, the high confidentiality impact rating reflects genuine risk of sensitive data disclosure from application memory, which may contain cached user data, API keys, or design content. The absence of confirmed public POCs and active exploitation, combined with the local-only nature, suggests this is a lower-priority issue than network-exploitable vulnerabilities with similar CVSS scores, though organizations with users who frequently handle untrusted EMF files should prioritize patching.

An attacker crafts a malicious EMF file containing specially formatted record headers with invalid size fields that exceed allocated buffer boundaries. The attacker emails this file to a user, social engineering them to open it in Canva Affinity under the pretense of needing design feedback. When Affinity parses the EMF file, the out-of-bounds read occurs, leaking nearby heap or stack memory contents that may include cached API credentials, user design data, or other sensitive information from the application process. Because the attack requires local file system access and user interaction to open the file, it is not suitable for large-scale remote exploitation, but remains viable as a targeted attack against specific users or organizations.