Canva CVE-2025-66503

The CVSS 3.1 score of 6.1 indicates a medium-severity issue with high confidentiality impact (C:H) but low availability impact (A:L) and no integrity impact (I:N). The attack vector is local (AV:L) with low complexity (AC:L) and no privilege requirement (PR:N), making exploitation straightforward once a user is tricked into opening a malicious file. The user interaction requirement (UI:R) limits the attack surface compared to remote exploits. Cross-referencing available signals: the vulnerability is reported by a reputable source (Cisco Talos), an advisory exists from Canva's trust portal, and the specificity of the affected version (3.0.1.3808) suggests this is a known and patched issue. The real-world risk is moderate to moderately-high because information disclosure vulnerabilities in design software can expose proprietary project data, customer information, or credentials from memory. However, the requirement for local file interaction and lack of network exploitability reduce the immediate threat scope compared to remote code execution vulnerabilities.

An attacker crafts a malicious EMF file and distributes it via email or file-sharing platform to a designer using Canva Affinity. When the victim opens the EMF file in Affinity (perhaps believing it to be a legitimate design asset), the application's EMF parser reads beyond the allocated buffer, exposing sensitive data such as previously opened file paths, authentication tokens, API keys, or other users' project data stored in adjacent memory. The attacker exfiltrates this information through side-channel observation (e.g., via debugger or memory dump utilities) or leverages the crash condition triggered by out-of-bounds access to infer memory layout and iterate on attacks. No public proof-of-concept code is referenced in the available intelligence, though the detailed advisory from Cisco Talos and Canva suggests responsible disclosure was followed.