Canva CVE-2025-66042

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L) indicates moderate-to-significant real-world risk: local attack vector limits exposure to users who can execute code or share files on the system, but low attack complexity and no privilege requirement mean any local user can trigger it. The high confidentiality impact (C:H) reflects genuine information disclosure potential, while the partial availability impact (A:L) suggests minor denial-of-service risk. The CVSS base score of 6.1 sits in the 'medium' severity band but leans toward the upper threshold. Critically, the vulnerability requires user interaction (UI:R) to open a specially crafted file, which reduces automated exploitation probability but remains practical in phishing or supply-chain scenarios. The lack of confirmed public proof-of-concept or KEV status indicates no widespread active exploitation observed at report time; however, the straightforward nature of out-of-bounds reads and the availability of technical details from Talos Intelligence and Canva's trust portal elevate the practical risk. This should be prioritized for patching in environments where Affinity users process untrusted EMF files.

An attacker crafts a malicious EMF file and delivers it to an Affinity user via email attachment or a compromised website. When the user opens the file in Affinity to preview or edit it, the EMF parser attempts to read metadata records without proper bounds validation. The out-of-bounds read operation accesses memory regions adjacent to the file buffer, allowing the attacker to exfiltrate sensitive data such as cached credentials, document contents, or other sensitive information resident in Affinity's process memory at the time of parsing.