Canva EUVD-2025-208783

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L) indicates a local attack vector with low complexity, no privilege requirement, and user interaction needed. The high confidentiality impact reflects the information disclosure risk, while the low availability impact suggests potential application instability rather than crash-level DoS. Exploitation probability is moderate—the attacker must craft a valid EMF file structure that triggers the out-of-bounds read, which requires some technical knowledge but is feasible. The requirement for user interaction (opening a file) and local access significantly reduces real-world risk compared to remote network vulnerabilities. No active exploitation in the wild or public POC has been documented in the provided intelligence, and no KEV listing is indicated. Given the moderate CVSS and user-interaction requirement, this should be prioritized for patching within standard security update cycles rather than treated as an emergency, though organizations handling sensitive files should elevate it. The information disclosure potential makes this more serious than a pure availability issue.

A user receives a seemingly innocuous EMF file via email or file-sharing service from an attacker. Upon opening the file in Canva Affinity, the malformed EMF record structure causes the application to read beyond allocated buffer boundaries, exposing adjacent memory containing sensitive session tokens or credentials that the application keeps in memory. The attacker then extracts and uses these leaked credentials to authenticate to other services or access sensitive data. The low attack complexity and common file format (EMF) make this plausible as a targeted attack against users handling design files, though the requirement for user action limits mass-exploitation potential.