Canva EUVD-2025-208797

The CVSS 3.1 score of 6.1 reflects a medium-severity vulnerability with a local attack vector, low attack complexity, no privileges required, and user interaction necessary (opening a file). The vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L indicates confidentiality impact is HIGH (memory disclosure), while integrity and availability impacts are minimal. However, SSVC and real-world risk assessment must account for: (1) the requirement for user interaction (UI:R) reduces likelihood of widespread exploitation compared to network-exposed vulnerabilities; (2) the local-only attack vector (AV:L) further constrains attack surface; (3) out-of-bounds reads, while serious, are typically harder to weaponize than buffer overflows or use-after-free bugs; and (4) the vulnerability discloses application memory rather than enabling code execution. Although Talos reported this vulnerability, no public POC is documented in the provided references, and KEV (Known Exploited Vulnerability) status is not indicated. This is a legitimate confidentiality concern for users handling untrusted EMF files, but exploitation likelihood is lower than comparable network-exploitable or memory-corruption vulnerabilities affecting widely-used libraries.

An attacker crafts a malicious EMF file with deliberately invalid record headers that specify out-of-bounds offsets or record lengths. The attacker sends this file to a target user via email or uploads it to a file-sharing service, social-engineering the user into opening it with Canva Affinity. When Affinity parses the malformed EMF without proper bounds validation, the parser reads memory beyond the allocated buffer, potentially exposing sensitive data (API keys, cached credentials, or other application state) that is then leaked to the attacker through side-channel observation, error messages, or subsequent file operations. No code execution results from this read-only access, limiting the attack to information disclosure.