Canva EUVD-2025-208791

The CVSS 3.1 score of 6.1 (Medium) reflects AV:L (Local Attack Vector), AC:L (Low Complexity), PR:N (No Privileges), and UI:R (User Interaction Required), with high confidentiality impact (C:H) but no integrity or availability impact (I:N, A:L). The local + user interaction requirement significantly reduces real-world exploitability compared to network-accessible vulnerabilities. The absence of KEV (Known Exploited Vulnerability) status and no confirmed POC availability further suggests low active exploitation probability. While the confidentiality impact is rated high, the actual sensitive data exposed depends on process memory state at exploitation time—making this a targeted information disclosure risk rather than a critical system compromise. For organizations using Affinity, this represents moderate priority requiring patching but not emergency response, especially if user awareness training is in place to avoid opening untrusted EMF files.

An attacker crafts a malicious EMF file containing out-of-bounds read instructions and sends it to a target user via email or file-sharing service, social engineering them to open it in Canva Affinity. Upon opening, the EMF parser processes the crafted file without properly validating buffer boundaries, causing a read operation that accesses memory regions outside the allocated EMF structure. The attacker recovers sensitive data from the exposed memory (such as encryption keys, tokens, or other process secrets) and uses this information for further attacks. The low attack complexity and lack of privilege requirements make this feasible for targeted attacks, though the requirement for user interaction and local file opening limits mass exploitation.