Affinity by Canva CVE-2026-103220

Exploitation requires a victim to open a maliciously crafted Affinity document (containing malformed raster image data) in the Affinity application at a version before 3.3.1; there is no network or remote trigger. Limiting factors are significant: the vector is local/file-based (AV:L), it requires user interaction to open the attacker-supplied file (UI:R), and attack complexity is high (AC:H) because the malformed raster data must reliably drive the out-of-bounds read and pointer dereference across variable memory conditions. No special product configuration is needed beyond having a vulnerable Affinity build installed and processing the untrusted document; patched builds (3.3.1 and later) are not affected.

This is a genuinely low-to-moderate priority issue despite being a memory-safety bug. The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L, base 4.5/Medium) describes a client-side, file-parsing vulnerability: the attacker has no network path (AV:L), must win against high attack complexity (AC:H) - crafting a document whose raster data lands the out-of-bounds read and untrusted-pointer dereference in an exploitable state - and must convince a user to open the file (UI:R). Impact is uniformly Low across confidentiality, integrity and availability, consistent with an OOB read that most realistically yields a crash or limited memory disclosure rather than reliable code execution. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation - exploitation status is best described as no public exploit identified at time of analysis. The SSVC picture is therefore benign: exploitation not observed, not automatable (each victim must manually open a document), and only partial technical impact. The signals are internally consistent - there is no CVSS-vs-description conflict here - so this reads as a legitimately modest desktop file-parser bug, not a high-urgency flaw. The only caveat is sourcing: the single reference is a Canva trust-portal link rather than a detailed advisory, so independent corroboration of the fix is limited.

A threat actor crafts a malicious Affinity document with malformed raster image data and distributes it via email attachment, a shared project file, or a download, relying on social engineering to get a designer to open it. When opened in a vulnerable Affinity build (before 3.3.1), the parser performs an out-of-bounds read and dereferences an untrusted pointer, producing an application crash or memory corruption. No public exploit code was identified in the provided data, and the high attack complexity (AC:H) makes reliable weaponization beyond a crash non-trivial.