Canva CVE-2026-20726

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L) indicates local attack vector requiring user interaction, low complexity, no privilege escalation, high confidentiality impact, no integrity impact, and low availability impact. The presence of references from Talos Intelligence (a reputable vulnerability research team) and the ENISA EUVD tracking suggest this is a credible, formally disclosed vulnerability rather than speculative. However, without confirmed EPSS score data, KEV status, or public proof-of-concept availability explicitly stated, the real-world exploitation risk appears moderate. The local attack vector and required user interaction (opening a malicious file) significantly reduce automation potential compared to remote vulnerabilities. The primary concern is information disclosure in multi-user or shared-device scenarios where an attacker can place crafted files for discovery. This is a priority for Affinity users who process untrusted EMF files, but lower urgency than remote code execution vulnerabilities.

An attacker crafts a malicious EMF file with out-of-bounds read gadgets and distributes it via email or file-sharing platforms with a social engineering pretext (e.g., 'design template' or 'logo artwork'). When a user opens the file in Canva Affinity, the application's EMF parser reads the crafted record data, triggering a memory access beyond the allocated buffer boundary. This allows the attacker to leak sensitive data from Affinity's memory—such as cached API tokens, previously opened document paths, or clipboard contents—which is then either returned to the attacker via side-channel analysis (timing/crashes) or exfiltrated if the application logs errors. The low complexity and straightforward delivery mechanism make this a practical attack for targeted information gathering against Affinity users handling sensitive design work.