Affinity by Canva CVE-2026-101094

Exploitation requires a victim to open an attacker-crafted Affinity document file (containing an incomplete UTF-8 character sequence) in the Affinity by Canva application at a version before 3.3.1; the flaw is in the document text parser, not any network service. Limiting factors are significant: the attack is local (AV:L) and requires user interaction (UI:R) to open the malicious file, exploitation is high-complexity (AC:H) because reliable heap disclosure depends on memory layout, and the outcome is confined to limited adjacent-heap information disclosure or an application crash with no integrity impact. There is no unauthenticated remote/network exploitation path.

This is a low-severity issue (CVSS 3.6) and the available signals consistently point to low real-world risk rather than a high-priority threat. The CVSS vector (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L) describes a local, high-complexity attack that requires a user to open a maliciously crafted Affinity document; it is not remotely or automatically exploitable. Impact is limited to disclosure of adjacent heap memory (C:L) or an application crash (A:L), with no integrity impact. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. AC:H reflects that reliably weaponizing a heap buffer over-read for meaningful data disclosure depends on heap layout and is non-trivial. No signals conflict here - this reads as a genuine but minor defect (confirmed and already patched by the vendor) rather than an urgent operational risk.

An attacker crafts an Affinity document containing a malformed/incomplete UTF-8 text sequence and delivers it to a victim (e.g., via email, shared asset libraries, or a download) who opens it in a vulnerable Affinity application before 3.3.1. Parsing the text triggers a heap buffer over-read that may leak bytes of adjacent heap memory into the document's text rendering or simply crash the application. No public exploit code was identified in the provided data, and the high attack complexity plus required user interaction make reliable exploitation difficult.