Canva CVE-2025-66617

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L) indicates local attack vector with low complexity and required user interaction; critically, confidentiality impact is high while integrity is none and availability is low. This profile is typical of information disclosure bugs: the attacker cannot modify or delete data, but can read sensitive memory contents (high C rating). The presence of Talos Intelligence as the discoverer and reporting entity, combined with an official vendor advisory URL (trust.canva.com), suggests responsible disclosure and likely patch availability. No KEV (Known Exploited Vulnerability) status or EPSS score was provided in the intelligence, which could indicate either nascent disclosure or low real-world exploitation probability. The requirement for user interaction (opening a malicious file) and local-only attack vector reduce immediate threat scope compared to remote network vulnerabilities, but targeted spear-phishing campaigns distributing crafted EMF files could exploit this effectively. For organizations using Affinity in production workflows, this is a moderate priority requiring prompt patching; for casual users, it poses lower risk unless they handle untrusted EMF files.

An attacker sends a targeted email to a Canva Affinity user containing a malicious EMF file, disguised as a legitimate design template or graphic asset. When the user opens the file in Affinity to review or edit it, the out-of-bounds read vulnerability is triggered, allowing the attacker to extract sensitive information from the application's memory such as authentication tokens, recently accessed file paths, or other user data resident in RAM. No code execution is required, making the attack surface purely informational disclosure, though the attacker could repeat this attack with multiple crafted files to incrementally map and exfiltrate more data.