EUVD-2025-208803Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 7.8 reflects high potential impact but requires local access (AV:L) and user interaction (UI:R), significantly limiting exploitation scenarios compared to network-based vulnerabilities. The attack complexity is low (AC:L) and requires no privileges (PR:N), meaning any local user can trigger it with a crafted file. No EPSS data was provided, suggesting exploitation probability hasn't been assessed yet. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no public proof-of-concept exists according to available intelligence. The SSVC decision framework would likely classify this as 'Track' rather than 'Act' priority due to requiring user interaction and lack of evidence of active exploitation. While the technical impact is severe (arbitrary code execution), the real-world risk is moderate for most organizations unless they regularly process untrusted EMF files. |
| Exploit ScenarioDerived | An attacker could craft a malicious EMF file and deliver it via email attachment or file-sharing platform, disguising it as legitimate clip art or graphics. When a victim opens the file in Affinity, the type confusion triggers memory corruption, allowing the attacker to execute arbitrary code with the privileges of the current user. Given the low attack complexity and the common use of EMF files in design workflows, this could be particularly effective in targeting creative professionals or marketing departments. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 17, 2026
A type confusion vulnerability in the EMF (Enhanced Metafile) functionality of Canva Affinity allows attackers to achieve arbitrary code execution through specially crafted EMF files. The vulnerability affects Affinity version 3.0.1.3808 and requires user interaction to trigger, as victims must open a malicious EMF file. With a CVSS score of 7.8 and local attack vector, this represents a significant risk for users handling untrusted graphic files, though no active exploitation or public POC has been reported.
RemediationAI
Update Canva Affinity to the latest version as recommended in the vendor's security advisory at https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62. Until patching is complete, avoid opening EMF files from untrusted sources and consider implementing application control policies to prevent execution from common download folders. Organizations should educate users about the risks of opening graphic files from unknown sources and consider using sandboxed environments for processing potentially malicious files. For detailed technical information about the vulnerability, see Talos Intelligence's report at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2297.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from improper type handling in Canva Affinity's EMF file parser, classified as CWE-843 (Access of Resource Using Incompatible Type - Type Confusion). EMF files are Windows vector graphics formats commonly used for clip art and diagrams. When Affinity processes a malformed EMF file, the type confusion leads to memory corruption where the application interprets data as a different type than intended. The affected product is identified through CPE as cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*, indicating all Affinity products (Designer, Photo, Publisher) are potentially vulnerable. This class of vulnerability is particularly dangerous because type confusion can allow attackers to manipulate memory layouts and hijack control flow.
Know when Canva gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A type confusion vulnerability exists in the EMF functionality of Canva Affinity. A specially crafted EMF file can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution.
Executive ViewAI
A critical vulnerability in Canva Affinity's EMF file handling could allow attackers to execute arbitrary code on user systems through malicious graphic files. This poses a direct risk to design teams and creative departments who regularly work with external or untrusted graphic assets, potentially compromising sensitive project data and system integrity.
Disable EMF file import functionality in Affinity if not essential to business operations; implement application whitelisting to restrict Affinity execution; enforce network segmentation to isolate design workstations; require file validation and sandboxed preview of external graphic files before opening in Affinity; deploy endpoint detection and response (EDR) tools to monitor for suspicious process execution originating from Affinity; establish file-type restrictions at email gateways and file-sharing platforms to limit EMF distribution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in Canva Affinity EMF Memory Corruption
View all 2Session hijacking in the Canva Android App before 2.376.0 lets an attacker-controlled web page interact with the Canva a
Session hijacking in the Canva Android App before version 2.376.0 arises from an unrestricted header-reflection flaw in
Unauthenticated configuration overwrite in the Ortto plugin for WordPress (versions before 1.0.25) lets a remote attacke
Opening an attacker-crafted Affinity document in Affinity by Canva versions prior to 3.3.0 can trigger a stack-based buf
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file processing functionality, al
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file handling functionality of Canva Affinity,
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, allow
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity,
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file handling that allows attacke
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file processing functionality, af
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity,
GitHub PoC
Exploit-DB