Canva CVE-2025-66000

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L) indicates local attack vector with low complexity, no privilege requirement, but necessary user interaction. The high confidentiality impact combined with low availability impact is typical of information disclosure bugs. The lack of integrity impact (I:N) means the attacker cannot modify data on the victim's system. While KEV status is not confirmed (not listed as actively exploited by adversaries), the straightforward attack surface—opening a file—combined with widespread use of Affinity in design workflows suggests practical exploit feasibility. The moderate CVSS score of 6.1 should not be dismissed; information disclosure vulnerabilities are often underestimated but can expose cryptographic keys, personal data, or application secrets. An EPSS score would clarify whether this aligns with real-world exploitation patterns, but the user-interaction requirement and local-only attack vector suggest lower automated exploitation probability compared to network-accessible vulnerabilities. Prioritize this as a standard patch cycle item rather than emergency response, but expedite if Affinity processes untrusted EMF files in automated workflows.

An attacker sends a victim a specially crafted EMF file (e.g., via email or collaboration platform) disguised as a legitimate design asset. When the victim opens the file in Canva Affinity to review or edit it, the EMF parser encounters a malformed record with an invalid size field that causes it to read beyond the allocated buffer. The out-of-bounds read leaks adjacent memory contents—potentially including encryption keys stored in heap memory, user credentials, or other application state—which the attacker may infer through timing differences or error messages, or directly if the vulnerability allows the leaked data to be written to a temporary file or log. No code execution occurs, but sensitive information is extracted.