Affinity by Canva EUVD-2026-95751

Exploitation requires a crafted Affinity document file to reach the victim's local macOS system and be rendered by the Affinity QuickLook thumbnail/preview extension - which occurs automatically when the user views the file or merely browses its folder in Finder, with no explicit open action (hence UI:N). Specific prerequisites: the target must be running Affinity by Canva for macOS before version 3.3.1 (so its QuickLook preview/thumbnail extension is installed and registered), and the malicious file must be present on local storage. Limiting factors that reduce real-world risk: the attack is local only (the file must first be delivered to the machine), attack complexity is high (AC:H - the attacker must precisely craft size metadata to trigger the integer overflow and groom the heap), the affected QuickLook extension runs within macOS's sandbox, and only macOS/Affinity-pre-3.3.1 installations are affected.

This is a genuinely low-to-moderate priority issue despite being a memory-corruption bug. The provided CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L = 4.9 Medium) tells a consistent story: exploitation is local (the malicious file must reach the victim's machine), requires high attack complexity (AC:H, reflecting the precise heap grooming and integer-overflow arithmetic needed to control the overflow), needs no privileges or explicit user interaction (QuickLook generates thumbnails/previews automatically in Finder), and yields only low impact across confidentiality, integrity, and availability. No EPSS score, KEV listing, or POC was provided in the intelligence set, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vendor-described outcome is a crash of the sandboxed preview/thumbnail extension - an availability nuisance - rather than demonstrated code execution; the C:L/I:L values reflect the latent potential of heap corruption (CWE-122) rather than a proven read/write primitive. There are no conflicting signals here: the local vector, high complexity, and low impact all point the same direction. The main reason to patch promptly is that thumbnail generation is automatic and attacker-triggered without a click, lowering the barrier to triggering the crash, but the sandboxing of macOS QuickLook extensions and the AC:H rating substantially cap real-world severity.

An attacker crafts a malicious Affinity document with manipulated dimension/size metadata and delivers it to a victim (e.g., via email, download, or a shared folder). When the victim merely browses the containing folder in Finder, macOS QuickLook automatically generates a thumbnail/preview, triggering the integer overflow and heap-based buffer overflow in the Affinity QuickLook extension. No public exploit code was provided, and the documented effect is a crash of the preview extension rather than confirmed remote code execution.