Affinity for macOS CVE-2026-96395

Exploitation requires the victim to use the Affinity for macOS app (version before 3.3.1) so its QuickLook thumbnail/preview generator is registered with the OS, and the victim must view or preview an attacker-supplied, specially crafted Affinity document file in Finder (opening the file in the app is not required - automatic QuickLook rendering suffices). Limiting factors: the attack is local-only (the file must reach the victim's machine), depends on user interaction (browsing to or selecting the file to trigger a preview), and succeeds reliably only given favorable heap layout (AC:H); it discloses only adjacent heap memory rather than attacker-chosen data, so it is primarily useful as an info-leak primitive to be chained with another vulnerability.

This is a genuinely low-priority issue whose signals are internally consistent rather than conflicting. The CVSS 3.1 base score of 3.6 (Low) is driven by a local attack vector (AV:L), high attack complexity (AC:H, reflecting the heap-layout dependence typical of out-of-bounds reads), required user interaction (UI:R), and only a partial confidentiality and availability impact (C:L/A:L) with no integrity impact (I:N). The flaw leaks adjacent heap memory - notably memory addresses, which is most useful as an ASLR-defeating primitive to be chained with a separate memory-corruption bug, not as a standalone compromise. No EPSS score, KEV listing, or public proof-of-concept was provided in the input, so there is no public exploit identified at time of analysis and no evidence of exploitation. PR:N technically indicates no privileges are required, but exploitation still hinges on an attacker delivering a malicious file and a victim previewing it in Finder, so real-world risk is modest. No key signals are contradictory: the low CVSS, absence of exploitation data, and info-disclosure-only impact all point to a real but minor vulnerability best handled via routine patching.

An attacker crafts a malicious Affinity document and delivers it to a victim via email, a shared drive, or a download. When the victim browses the containing folder and macOS Finder/QuickLook auto-generates a thumbnail or preview, the out-of-bounds heap read renders adjacent process memory - potentially including memory addresses - into the preview image, which the attacker could recover. No public exploit code was identified in the provided data.