Canva EUVD-2025-208793

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L) indicates a local attack vector requiring only user interaction and no elevated privileges, with high confidentiality impact but negligible integrity and low availability risk. The attack complexity is low, suggesting straightforward exploitation once a crafted EMF file is delivered. The attack surface is localized to the user's system with no lateral movement capability (S:U), limiting scope. While CVSS assigns moderate severity (6.1), real-world risk depends on whether Canva Affinity processes untrusted EMF files in common workflows and whether sensitive data is likely to reside in adjacent memory. The information disclosure nature of this vulnerability makes it suitable for targeted attacks against Affinity users handling design files from untrusted sources. No active exploitation data or public POC availability is documented in provided intelligence, and no KEV (Known Exploited Vulnerability) designation is evident, suggesting this remains a lower-priority threat compared to actively exploited vulnerabilities, though opportunistic exploitation remains plausible once weaponized tools emerge.

An attacker crafts a malicious EMF file with intentionally malformed record headers that cause the parser to read memory beyond the allocated buffer. A user is social-engineered or tricked into opening the file via email attachment or shared cloud storage, triggering the vulnerability within Affinity's file import process. Upon rendering, the out-of-bounds read silently executes; sensitive data in adjacent memory (such as encryption keys, authentication tokens, or clipboard contents) may be leaked through application error messages, crash dumps, or indirect information leakage channels, potentially enabling follow-up attacks or credential compromise. No public POC is currently known to exist, but the low attack complexity suggests that exploitation would become trivial once technical details are widely disseminated.