What is the CVSS score of EUVD-2025-208785?

EUVD-2025-208785 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Affinity are affected by EUVD-2025-208785?

CVE-2025-58427 presents moderate security risk, a out-of-bounds read vulnerability rated CVSS 6.1. Exploitation could cause memory corruption or application crashes.

How to fix or mitigate EUVD-2025-208785?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Affinity EUVD-2025-208785

| CVE-2025-58427 MEDIUM

Out-of-bounds Read (CWE-125)

2026-03-17 talos

Buffer Overflow Information Disclosure Affinity

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 17, 2026 - 20:30 euvd

EUVD-2025-208785

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

CVE Published

Mar 17, 2026 - 18:52 nvd

MEDIUM 6.1

DescriptionCVE.org

An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.

AnalysisAI

An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, affecting Affinity version 3.0.1.3808 and potentially other versions. An attacker can craft a malicious EMF file that, when opened by a user in Affinity, triggers an out-of-bounds memory read, potentially disclosing sensitive information from process memory. With a CVSS score of 6.1 and a local attack vector requiring user interaction, this vulnerability poses a moderate risk of information disclosure with minimal availability impact.

Technical ContextAI

The vulnerability resides in Canva Affinity's EMF (Enhanced Metafile) file parsing logic, which is responsible for interpreting Windows-based vector graphics files. EMF is a legacy Microsoft graphics format that contains sequences of graphics device interface (GDI) commands. The root cause is classified under CWE-125 (Out-of-bounds Read), indicating that the EMF parser fails to properly validate buffer boundaries when processing EMF record structures or embedded data. When a crafted EMF file with malformed record headers or oversized data fields is processed, the parser reads beyond allocated memory buffers, exposing adjacent heap or stack memory. The affected product is identified via CPE cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*, confirming this affects Canva's Affinity design suite across multiple versions.

RemediationAI

Immediately upgrade Canva Affinity to the patched version referenced in the Canva trust advisory (https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62). Until patching is complete, users should avoid opening EMF files from untrusted sources and consider disabling EMF import functionality if not essential to workflow. System administrators should restrict file uploads and enforce content scanning for EMF files in shared repositories. Endpoint detection and response (EDR) tools should be configured to alert on abnormal memory access patterns in Affinity processes. As a compensating control, restrict Affinity execution to isolated user contexts to limit the sensitivity of disclosed information.