Canva CVE-2025-66633

This vulnerability presents moderate real-world risk despite its 6.1 CVSS score. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L) indicates low attack complexity and no privilege requirements, but critically requires local attack vector and user interaction—an attacker must convince a user to open a malicious EMF file. The high confidentiality impact (C:H) reflects the out-of-bounds read's potential to leak sensitive data, while the low availability impact (A:L) suggests the vulnerability does not reliably cause denial of service. The Talos Intelligence reporting and ENISA EUVD cataloging (EUVD-2025-208807) suggest this is a confirmed, investigated vulnerability with vendor engagement; however, no KEV (Known Exploited Vulnerability) catalog listing was identified in the provided intelligence, and no public proof-of-concept appears to be widely available. Practical exploitation depends on attackers' ability to deliver a malicious EMF file through email, shared documents, or web downloads, making this a concern primarily for targeted attacks or supply-chain scenarios rather than mass exploitation. Organizations using Affinity should prioritize patching, but this is not an emergency-tier vulnerability.

An attacker crafts a malicious EMF file with oversized or malformed record headers and sends it to a target user via email or file-sharing platform. When the user opens the file in Canva Affinity, the EMF parser attempts to read the record data without proper bounds validation, triggering an out-of-bounds read that leaks adjacent heap or stack memory—potentially containing API keys, authentication tokens, or other application data—to the attacker through a side-channel observation (e.g., crash logs, observable application behavior, or memory disclosure via subsequent operations). The attack succeeds because it requires only user-level privileges and a single interaction (opening the file), with low attack complexity and no exploitation framework prerequisites, making it practical for targeted spear-phishing campaigns against design professionals using Affinity.