What is the CVSS score of EUVD-2025-208803?

EUVD-2025-208803 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Affinity are affected by EUVD-2025-208803?

A critical vulnerability in Canva Affinity's EMF file handling could allow attackers to execute arbitrary code on user systems through malicious graphic files.

How to fix or mitigate EUVD-2025-208803?

Within 24 hours: Issue security alert to all Affinity users advising against opening EMF files from untrusted sources and implement file handling policies. Within 7 days: Inventory all systems running Affinity 3.0.1.3808, restrict EMF file imports to trusted sources only, and consider disabling EMF functionality if not business-critical. Within 30 days: Monitor vendor communications for patch availability, evaluate migration to alternative design tools if patch timeline is uncertain, and conduct security awareness training on file-based attack vectors.

Affinity EUVD-2025-208803

| CVE-2025-66342 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-03-17 talos

Buffer Overflow RCE Memory Corruption Affinity

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 17, 2026 - 20:30 euvd

EUVD-2025-208803

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

CVE Published

Mar 17, 2026 - 18:52 nvd

HIGH 7.8

DescriptionCVE.org

A type confusion vulnerability exists in the EMF functionality of Canva Affinity. A specially crafted EMF file can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution.

AnalysisAI

A type confusion vulnerability in the EMF (Enhanced Metafile) functionality of Canva Affinity allows attackers to achieve arbitrary code execution through specially crafted EMF files. The vulnerability affects Affinity version 3.0.1.3808 and requires user interaction to trigger, as victims must open a malicious EMF file. With a CVSS score of 7.8 and local attack vector, this represents a significant risk for users handling untrusted graphic files, though no active exploitation or public POC has been reported.

Technical ContextAI

The vulnerability stems from improper type handling in Canva Affinity's EMF file parser, classified as CWE-843 (Access of Resource Using Incompatible Type - Type Confusion). EMF files are Windows vector graphics formats commonly used for clip art and diagrams. When Affinity processes a malformed EMF file, the type confusion leads to memory corruption where the application interprets data as a different type than intended. The affected product is identified through CPE as cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*, indicating all Affinity products (Designer, Photo, Publisher) are potentially vulnerable. This class of vulnerability is particularly dangerous because type confusion can allow attackers to manipulate memory layouts and hijack control flow.

RemediationAI

Update Canva Affinity to the latest version as recommended in the vendor's security advisory at https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62. Until patching is complete, avoid opening EMF files from untrusted sources and consider implementing application control policies to prevent execution from common download folders. Organizations should educate users about the risks of opening graphic files from unknown sources and consider using sandboxed environments for processing potentially malicious files. For detailed technical information about the vulnerability, see Talos Intelligence's report at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2297.