EUVD-2025-208783
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
Lifecycle Timeline
3Description
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
Analysis
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file handling functionality, affecting Affinity version 3.0.1.3808 and potentially other versions. An attacker can craft a malicious EMF file that, when opened by a user in Affinity, triggers an out-of-bounds memory read, potentially disclosing sensitive information from process memory such as authentication tokens, cryptographic keys, or other confidential data. The vulnerability requires user interaction (opening a file) and local access, making it a moderate-priority issue with a CVSS base score of 6.1, though the high confidentiality impact warrants prompt patching.
Technical Context
The vulnerability is rooted in improper bounds checking during EMF file parsing within Canva Affinity (CPE: cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*), classified under CWE-125 (Out-of-bounds Read). EMF is a vector graphics format commonly used in Microsoft Windows environments that contains complex record structures. The flaw occurs when Affinity processes specially crafted EMF records without validating that memory reads remain within allocated buffer boundaries. This allows an attacker-controlled file to reference invalid memory offsets, causing the application to read and potentially leak adjacent memory regions. The vulnerability is fundamentally a missing or inadequate bounds validation check in the EMF record deserialization logic.
Affected Products
Canva Affinity version 3.0.1.3808 is confirmed affected according to ENISA EUVD data (EUVD-2025-208783). The CPE cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:* indicates the vulnerability may affect multiple Affinity versions; however, only 3.0.1.3808 has been explicitly confirmed. Users should check the Canva Trust Center advisory at https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62 for definitive version scope and remediation details. The Talos Intelligence vulnerability report (TALOS-2025-2316) at https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2316 provides additional technical context.
Remediation
Users should upgrade Canva Affinity to a patched version released by Canva following the disclosure timeline; consult the Canva Trust Center advisory at https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62 and Talos report at https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2316 for the specific fixed version number. Until an official patch is available, users should avoid opening EMF files from untrusted sources and disable EMF file type handling in Affinity if the application supports it. System administrators can reduce attack surface by restricting user permissions to open files only from verified sources and implementing application whitelisting policies. For organizations that must continue using affected versions, isolate systems handling potentially malicious EMF files on restricted networks with minimal access to sensitive data.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today