What is the CVSS score of CVE-2026-22882?

CVE-2026-22882 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Affinity are affected by CVE-2026-22882?

CVE-2026-22882 presents moderate security risk, a out-of-bounds read vulnerability rated CVSS 6.1. Exploitation could cause memory corruption or application crashes.

How to fix or mitigate CVE-2026-22882?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Affinity CVE-2026-22882

EUVD-2026-12618 MEDIUM

Out-of-bounds Read (CWE-125)

2026-03-17 talos

Buffer Overflow Information Disclosure Affinity

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 17, 2026 - 20:30 euvd

EUVD-2026-12618

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

CVE Published

Mar 17, 2026 - 18:52 nvd

MEDIUM 6.1

DescriptionCVE.org

An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.

AnalysisAI

Canva Affinity's EMF file parser is vulnerable to an out-of-bounds read (CWE-125) when processing specially crafted EMF files, allowing local attackers to extract sensitive data from application memory. This medium-severity vulnerability affects users who open untrusted EMF files and currently has no available patch. The attack requires user interaction and local access but poses a real information disclosure risk.

Technical ContextAI

The vulnerability is rooted in improper bounds checking when parsing EMF (Enhanced Metafile) format files, a legacy graphics file format commonly used for vector graphics interchange on Windows systems. The root cause is classified under CWE-125 (Out-of-bounds Read), which occurs when a program reads data from a memory location outside the intended buffer boundaries without proper validation. Canva Affinity (CPE: cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*) handles EMF file import for compatibility with legacy graphics workflows, but the EMF parsing library or in-house parser fails to validate record lengths and offsets before dereferencing memory structures. This allows an attacker to craft an EMF file with malformed record headers that cause the parser to read adjacent memory regions, potentially exposing heap data, stack contents, or other sensitive process information.

RemediationAI

Apply the security patch provided by Canva through the official security advisory at https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62 to upgrade Affinity to a patched version that includes bounds-checked EMF parsing. Until patching is completed, mitigate by disabling EMF file import in Affinity if the feature is non-essential for workflows, or restrict file handling to EMF files from trusted sources only. System administrators managing Affinity deployments should implement file type filtering at the network or endpoint level to block unexpected EMF file delivery. Additionally, monitor for suspicious file submissions with EMF extensions and educate users not to open unsolicited EMF files from untrusted sources.