Canva EUVD-2025-208798

The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L) indicates local attack vector with low complexity, no privilege requirement, required user interaction, and high confidentiality impact with low availability impact. This presents a moderate real-world risk: while the vulnerability requires user action (opening a malicious file), the low attack complexity and lack of privilege requirements lower the barrier to exploitation. The information disclosure capability (C:H) is significant for data exfiltration scenarios, particularly if users work with sensitive documents. Absence of integrity or system-wide availability impact (I:N, A:L) prevents full system compromise, but the vulnerability still qualifies as exploitable via social engineering (tricking users into opening crafted EMF files). The presence of Talos Intelligence reporting and Canva vendor acknowledgment (trust.canva.com) indicates this is a confirmed, non-theoretical vulnerability warranting timely patching.

An attacker crafts a malicious EMF file with specially formatted record headers designed to trigger out-of-bounds memory access, then delivers it via email or hosts it on a compromised website with social engineering (e.g., 'Please review this design mockup in Affinity'). When a target user opens the file in Canva Affinity, the EMF parser fails to validate buffer boundaries and reads memory beyond the intended buffer, exposing sensitive data such as previously processed document content, application state, or other in-memory information that may be leaked through application behavior or crash messages. The attacker extracts this information to identify valuable data or refine further attacks, without requiring any special privileges or system access.