Affinity by Canva EUVD-2026-95753

Exploitation requires a victim to open an attacker-crafted Affinity document file (containing a malformed array of strings) in the Affinity application prior to version 3.3.1 - i.e., it is file-parsing-triggered and depends on user interaction (UI:R) and local file delivery (AV:L), not remote network reachability. There is no authentication requirement (PR:N), but the limiting factors are significant: the attacker must socially engineer the victim into opening the malicious document, the over-read is bounded by heap layout (AC:H) so any disclosed memory is non-deterministic, and the most likely outcome is an application crash rather than reliable data theft. Default installations of Affinity are affected (no special feature or configuration toggle is named), but only when the user actively opens the malicious file.

This is a genuinely low-priority issue despite being a memory-safety bug. The provided CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L, base 3.6) is self-consistent with the description: exploitation is local (the attacker must get a crafted Affinity document opened on the victim's machine - AV:L), requires user interaction (UI:R), and carries high attack complexity (AC:H) because a heap over-read depends on non-deterministic heap layout to leak anything useful. Impact is limited to partial confidentiality (C:L, disclosure of adjacent heap memory that may surface in document text) and partial availability (A:L, application crash), with no integrity impact and no code execution. No EPSS score, KEV listing, or POC was provided; by the precision rules this is 'no public exploit identified at time of analysis.' All signals align toward low real-world risk - there is no conflict between CVSS severity and threat-intel signals here, and no evidence of active exploitation. The main caveat is that absence of EPSS/KEV/POC data in the input is not proof of absence in the wild, only that it was not supplied.

A threat actor crafts a malicious Affinity document containing a malformed array of strings and sends it to a target (e.g., as a shared design file or email attachment). When the victim opens it in a vulnerable Affinity application (before 3.3.1), the parser over-reads the heap, potentially embedding fragments of adjacent process memory into the document's displayed text or crashing the application. No public exploit code was identified, and the local vector plus required user interaction and high complexity make reliable, targeted information disclosure difficult.