EUVD-2026-81313
GHSA-fq87-2rvp-5478
Severity by source
AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Local file-parsing bug needing the victim to open a crafted document (AV:L/UI:R), difficult reliable exploitation (AC:H); I assess S:U (overflow stays within the app process) versus the vendor's S:C, with full C/I/A on code execution.
Primary rating from Vendor (Canva).
CVSS VectorVendor: Canva
Lifecycle Timeline
3DescriptionCVE.org
The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when parsing Affinity document files leading to a stack-based buffer overflow. A threat actor could craft a Affinity document that when opened by a user in Affinity could result in arbitrary code execution.
AnalysisAI
Opening an attacker-crafted Affinity document in Affinity by Canva versions prior to 3.3.0 can trigger a stack-based buffer overflow that may lead to arbitrary code execution on the victim's endpoint. Exploitation is not remote or automatic: it requires the user to open the malformed document (UI:R) on a machine where Affinity is installed, and attack complexity is assessed as high (AC:H), reflecting the difficulty of turning the stack corruption into reliable code execution in the presence of modern stack and memory protections. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a user to open an attacker-crafted Affinity document file in the Affinity application (by Canva) at a version before 3.3.0; the malformed file triggers inadequate bounds checking during document parsing (CWE-121 stack overflow). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but not top-tier priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Affinity by Canva to version 3.3.0 (the September 2026 release), which is the vendor-released patch that adds the missing bounds checks in the document parser; install it through the application's built-in update mechanism or from the vendor's download page, and verify the installed build number afterwards. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Affinity by Canva installations, flag any version prior to 3.3.0 as affected, and instruct users not to open Affinity documents from untrusted or unexpected sources; where possible, quarantine or block such attachments at email and web gateways. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A type confusion vulnerability in the EMF (Enhanced Metafile) functionality of Canva Affinity allows attackers to achiev
An out-of-bounds write vulnerability in Canva Affinity's EMF file processing allows attackers to achieve code execution
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file processing functionality, al
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file handling functionality of Canva Affinity,
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, allow
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity,
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file handling that allows attacke
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file processing functionality, af
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity,
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, affec
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, affec
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file handling functionality, affe
Same weakness CWE-121 – Stack-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today