Affinity EUVD-2026-95749

Exploitation requires that a crafted Affinity document file reside on the victim's macOS system and that the victim view or preview it in Finder, triggering the QuickLook thumbnail/preview extension - the specific vulnerable code path is Affinity's QuickLook thumbnail and preview generation, which fails to validate declared image dimensions against actual pixel-data size. Limiting factors: the attack is local (the malicious file must first reach the host), only affects Affinity for macOS before version 3.3.1, requires the victim to browse to or preview the file, and yields only a non-deterministic read of adjacent heap memory - the attacker cannot choose what is disclosed, which substantially limits reliable data exfiltration.

This is a genuinely low-priority issue despite being a memory-safety bug. The provided CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) and base score of 2.9 reflect a local attack vector, high attack complexity (heap over-read of adjacent memory is non-deterministic and layout-dependent), and only low confidentiality impact with no integrity or availability impact. There is no EPSS score, no CISA KEV listing, and no public POC referenced - exploitation signal is uniformly weak: no public exploit identified at time of analysis. One internal inconsistency worth noting: the vector sets UI:N, yet the description requires a victim to view or preview the crafted file in Finder, which is at minimum passive user interaction - the UI:N rating hinges on the fact that macOS QuickLook auto-generates thumbnails when a folder is merely browsed, so no explicit click is needed. Also note the vector sets A:N even though the description explicitly states the preview extension can be crashed, which is a (low) availability impact. Net: a legitimate out-of-bounds heap read (CWE-126) that leaks small amounts of adjacent heap memory into a rendered thumbnail, but the local vector, high complexity, information-only impact, and complete absence of exploitation evidence make this a routine patch-on-cycle item, not an urgent one.

An attacker crafts an Affinity document whose declared image dimensions exceed the actual pixel-data buffer and delivers it to a victim (e.g., via download, email attachment, or shared folder). When the victim browses the containing folder or previews the file in macOS Finder, QuickLook generates a thumbnail and reads past the end of the pixel buffer, rendering adjacent heap memory into the preview image or crashing the preview extension. No public exploit code is identified, and the leaked contents are non-deterministic, so practical weaponization for targeted data theft is difficult.