EUVD-2025-208807CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
Lifecycle Timeline
3Description
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
Analysis
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity, allowing attackers to read memory beyond allocated buffer boundaries when processing specially crafted EMF files. The vulnerability affects Canva Affinity version 3.0.1.3808 and potentially other versions in the product line; attackers with local access and user interaction can trigger the flaw to disclose sensitive information from process memory. While the CVSS score of 6.1 indicates medium severity with high confidentiality impact and low availability impact, the attack requires local file system access and user interaction (opening a malicious EMF file), limiting widespread exploitation risk.
Technical Context
The vulnerability resides in Canva Affinity's EMF (Enhanced Metafile) file parser, a legacy Windows graphics format handler that processes vector-based drawing instructions. The root cause is classified under CWE-125 (Out-of-bounds Read), a memory safety vulnerability where the parser fails to validate buffer boundaries before reading EMF record structures, potentially allowing it to access memory regions outside the intended allocation. EMF files contain records with variable-length data, and improper bounds checking during record parsing enables attackers to craft files with malformed record headers or oversized data fields that cause the parser to read adjacent memory. The affected product is identified via CPE as cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*, confirming the vulnerability spans Canva's Affinity design application suite.
Affected Products
Canva Affinity version 3.0.1.3808 is confirmed affected according to ENISA EUVD data. The vulnerability likely affects other versions within the Affinity 3.x line and potentially earlier versions, as indicated by the CPE range cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*, though vendor advisories should be consulted to determine the exact version range. Users are directed to review the official Canva security advisory at https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62 and the Talos Intelligence report at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2313 for authoritative patch availability and version details.
Remediation
Upgrade Canva Affinity to the latest patched version provided by the vendor; consult the official Canva security advisory (https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62) for specific patch version numbers. Until patching is completed, implement mitigations by disabling or restricting EMF file handling in Affinity if alternative file formats are acceptable, educating users not to open EMF files from untrusted sources, and deploying file-type filtering policies to block EMF downloads in email and web gateways. Organizations can monitor for exploitation attempts by tracking access to Affinity crash dumps and memory errors in log files, and isolating affected systems from critical data repositories if suspicious EMF file opens are detected.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today