Affinity by Canva EUVD-2026-95748

Exploitation requires an attacker to deliver a specially crafted Affinity document file and have a victim open it in the Affinity by Canva desktop application on a version earlier than 3.3.1 (the October 2026 release); the malformed file triggers an out-of-bounds pointer dereference during document parsing. Limiting factors are significant: the CVSS vector is local (AV:L) with required user interaction (UI:R), meaning there is no remote or automatic trigger - the user must actively open the attacker-supplied file, typically via social engineering or a trusted-looking shared asset. No authentication is required of the attacker (PR:N), but the impact is confined to crashing the application; no code execution or data disclosure is described. Users on 3.3.1 or later, or who do not open untrusted Affinity files, are not exposed.

This is a genuinely low-priority issue, and the available signals are consistent rather than conflicting. The vendor/NVD CVSS 3.1 vector (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L, base 3.6) describes a local, user-interaction-dependent flaw whose only demonstrated impact is an application crash - no confidentiality impact and only low integrity/availability impact. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the intelligence, so this reflects no public exploit identified at time of analysis and no evidence of active or automatable exploitation. CWE-822 (untrusted pointer dereference) can in some cases escalate beyond denial of service, but the description explicitly limits the outcome to an application crash, so treating this as anything more than a stability/DoS bug would overstate the risk. One minor caveat: the vendor rated I:L, yet a pure crash from an out-of-bounds pointer dereference is more naturally an availability (A) impact - the low integrity rating is not substantiated by the described crash-only behavior and should be verified with Canva if integrity consequences matter to your assessment.

An attacker crafts a malicious Affinity document and delivers it to a target (e.g., a designer or studio) via email, a shared asset library, or a download, relying on social engineering to get it opened. When the victim opens the file in a vulnerable Affinity by Canva build (before 3.3.1), inadequate bounds checking triggers an out-of-bounds pointer dereference and the application crashes, losing unsaved work. No public exploit code was identified, and the attack only produces a crash rather than code execution.