Canva EUVD-2025-208785

The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L) indicates a local attack vector requiring no privileges but mandating user interaction, with high confidentiality impact and low availability impact. The primary risk is information disclosure rather than code execution. Without EPSS score data explicitly provided, the real-world exploitation probability cannot be quantified precisely, but the local-attack-vector requirement and need for user interaction (opening a malicious file) moderate the practical risk compared to network-exploitable vulnerabilities. The absence of explicit KEV (Known Exploited Vulnerability) designation or public POC information suggests this is not yet widely exploited in the wild, though security researchers (Talos) have validated the vulnerability. From an SSVC perspective, the technical impact is high (information disclosure), exploitation is unproven at scale, and the condition is not automatable without user action, placing this in a medium-priority remediation window rather than critical.

An attacker crafts a malicious EMF file containing specially formatted records with buffer overrun markers and distributes it via email or a file-sharing service. When a designer at a marketing firm opens the file in Canva Affinity to review artwork, the EMF parser reads beyond its allocated buffer boundaries, accessing adjacent memory regions containing cached user credentials, API tokens, or portions of previously opened design documents. The attacker cannot achieve code execution or directly crash the application (low availability impact), but the out-of-bounds read silently exfiltrates sensitive data if the application transmits memory snapshots or logs to diagnostic services, or the attacker uses a local post-exploitation technique to extract the process memory.