Canva CVE-2026-22882

The CVSS v3.1 score of 6.1 reflects a medium-to-moderately-high risk profile, with the vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L) indicating low attack complexity and local access requirement, but high confidentiality impact and low availability impact. The local attack vector and requirement for user interaction (UI:R—opening a malicious file) significantly reduce real-world exploitability compared to remote network-based vulnerabilities. While CVSS assigns a 6.1 rating, the actual exploitation probability depends on attacker ability to deliver a weaponized EMF file to a user and the predictability of leaked memory contents; this is not a high-automation scenario unlike SQL injection or unauthenticated RCE vulnerabilities. No KEV (Known Exploited Vulnerability) status or public proof-of-concept availability is indicated in the provided intelligence, which lowers immediate threat urgency. For SSVC assessment: exploitation is unproven, the attack is not automatable at scale (requires social engineering), and technical impact is primarily confidentiality loss rather than system compromise. This vulnerability is a legitimate security concern for users handling untrusted EMF files but does not warrant emergency patching equivalent to critical RCE vulnerabilities.

An attacker crafts a malicious EMF file with intentionally malformed record headers that specify out-of-bounds offsets, then distributes it via email or file-sharing platform disguised as a legitimate graphic design asset. When a Canva Affinity user opens the file, the EMF parser reads the malformed record structure, dereferences the attacker-controlled offset without bounds validation, and leaks sensitive data from adjacent memory regions (such as cryptographic keys, user credentials, or other sensitive variables) that can be exfiltrated through timing or crash analysis. No public proof-of-concept is currently documented in the provided intelligence, but the low attack complexity (AC:L) and straightforward memory read operation suggest weaponization is feasible for a motivated attacker.