Canva EUVD-2025-208799

The CVSS v3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L) indicates this is a local attack vector requiring user interaction (opening a file) but no privileges, with high confidentiality impact and low availability impact, producing a base score of 6.1. The attack complexity is low, meaning exploitation does not require special conditions beyond crafting a malicious EMF file. While the CVSS score is moderate, the high confidentiality impact (C:H) is significant for information disclosure scenarios. The presence of multiple authoritative sources (Talos Intelligence, ENISA EUVD-2025-208799, and Canva's trust portal) suggests this is a confirmed, well-researched vulnerability rather than unvalidated conjecture. Without explicit KEV (Known Exploited Vulnerability) status or public POC confirmation in the provided data, real-world exploitation risk appears lower than if this were actively weaponized; however, the low attack complexity and straightforward trigger mechanism (user opening a file) mean exploitation is feasible. The vulnerability should be prioritized based on the prevalence of EMF file handling in office/design workflows, but it does not present the same urgency as a network-based RCE or actively exploited memory corruption bug.

An attacker crafts a malicious EMF file with specially formatted records that cause the parser to miscalculate buffer boundaries during record processing. When a user opens the file in Canva Affinity (via File > Open or drag-and-drop), the EMF parser reads beyond the allocated buffer, exposing sensitive data such as previously-processed document content, API tokens, or other in-memory secrets to the attacker. The attack requires user interaction (opening the file) but no special privileges, making it suitable for targeted phishing or social engineering campaigns where the EMF file is delivered via email or cloud sharing platforms.