EUVD-2026-81317
GHSA-h8gp-q3m8-2gvr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Deeplink is remotely deliverable (AV:N) and simple to craft (AC:L), but requires the user to open it (UI:R); impact is limited to loading same-origin content, hence I:L and C:N/A:N.
Primary rating from Vendor (Canva).
CVSS VectorVendor: Canva
Lifecycle Timeline
3DescriptionCVE.org
Canva Desktop before v1.125.0 performed double decoding in the deeplink handler. A threat actor could cause the application to load arbitrary same-origin content under the user’s session.
AnalysisAI
Double decoding in the Canva Desktop deeplink handler (versions before 1.125.0) lets an unauthenticated attacker who convinces a user to open a crafted custom-URI deeplink cause the application to load arbitrary same-origin content within that user's session. The flaw (CWE-174) yields limited integrity impact only, with no confidentiality or availability effect, and exploitation requires user interaction (UI:R). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the victim to be running Canva Desktop before v1.125.0 and to open a crafted deeplink (custom URI scheme) whose double-encoded payload evades the handler's validation (CWE-174 double decoding). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity, client-side flaw, not an urgent priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Canva Desktop to v1.125.0 or later - this is the vendor-released patch and the only complete fix; consult the Canva advisory at https://trust.canva.com/?tcuUid=d98fa5aa-50ac-4e45-8fec-2c8d07f2b9b6 for distribution details. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Session hijacking in the Canva Android App before 2.376.0 lets an attacker-controlled web page interact with the Canva a
Session hijacking in the Canva Android App before version 2.376.0 arises from an unrestricted header-reflection flaw in
A type confusion vulnerability in the EMF (Enhanced Metafile) functionality of Canva Affinity allows attackers to achiev
An out-of-bounds write vulnerability in Canva Affinity's EMF file processing allows attackers to achieve code execution
Opening an attacker-crafted Affinity document in Affinity by Canva versions prior to 3.3.0 can trigger a stack-based buf
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file processing functionality, al
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file handling functionality of Canva Affinity,
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, allow
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity,
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file handling that allows attacke
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file processing functionality, af
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity,
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today