EUVD-2025-208805
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
Lifecycle Timeline
3Description
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
Analysis
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, affecting Affinity version 3.0.1.3808 and potentially earlier versions. An attacker can craft a malicious EMF file that, when opened by a user in Affinity, triggers an out-of-bounds memory read, potentially disclosing sensitive information from the application's memory space. With a CVSS score of 6.1 and a local attack vector requiring user interaction, this vulnerability poses a moderate risk primarily through information disclosure, though local denial of service is also possible.
Technical Context
The vulnerability resides in the EMF (Enhanced Metafile) file parsing code within Canva Affinity (CPE: cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*), a professional design and publishing application. EMF is a Windows vector graphics format that stores drawing instructions; improper bounds checking during EMF record parsing fails to validate memory access offsets, resulting in CWE-125 (Out-of-bounds Read). When Affinity processes a specially crafted EMF file with malformed record headers or invalid offset values, the parser reads memory beyond allocated buffer boundaries. This class of vulnerability typically occurs in legacy or complex file format handlers where size validation is incomplete, and EMF files with nested structures and variable-length records present particular parsing challenges.
Affected Products
Canva Affinity version 3.0.1.3808 is confirmed affected according to EUVD-2025-208805. The CPE string cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:* indicates the vulnerability likely affects multiple versions across the product line, though the specific version range (e.g., 3.0.1.3808 and potentially earlier) should be verified against the vendor advisory at https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62 and the Talos Intelligence report at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2315. Users should consult these official sources to determine their exact exposure.
Remediation
Immediately upgrade Canva Affinity to the patched version released by the vendor; consult the official Canva security advisory at https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62 for the specific fixed version number and download instructions. Until patching is possible, implement compensating controls by restricting users' ability to open EMF files from untrusted sources, disabling EMF import in Affinity if that feature is optional, and educating users not to open EMF files from unknown or suspicious origins. Organizations handling sensitive data should monitor their Affinity installations for any unexpected behavior or memory dumps that might indicate exploitation. Additionally, review access logs to identify whether any users have opened potentially malicious EMF files.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today