Canva
Monthly
Unauthenticated configuration overwrite in the Ortto plugin for WordPress (versions before 1.0.25) lets a remote attacker rewrite the plugin's stored settings and turn the site into a delivery point for arbitrary scripts. The configuration-update request is never authenticated; the only gate is a secret that is exposed in public page HTML, so no credentials, user interaction, or non-default configuration is required on any site running an affected version. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the vendor has released a fix in 1.0.25 and the issue was reported by Canva, the plugin's maintainer.
Opening an attacker-crafted Affinity document in Affinity by Canva versions prior to 3.3.0 can trigger a stack-based buffer overflow that may lead to arbitrary code execution on the victim's endpoint. Exploitation is not remote or automatic: it requires the user to open the malformed document (UI:R) on a machine where Affinity is installed, and attack complexity is assessed as high (AC:H), reflecting the difficulty of turning the stack corruption into reliable code execution in the presence of modern stack and memory protections. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at the time of analysis, and the risk is genuine but not top-tier - it is confined to endpoints that handle untrusted Affinity files.
Session hijacking in the Canva Android App before version 2.376.0 arises from an unrestricted header-reflection flaw in a privileged WebView component. An attacker who can control an external origin loaded within that WebView receives sensitive HTTP headers - including session tokens - that the app fails to suppress, exposing the authenticated user's session and enabling full account takeover. No public exploit has been identified at time of analysis; the flaw is patched in v2.376.0 per the Canva trust advisory.
Session hijacking in the Canva Android App before 2.376.0 lets an attacker-controlled web page interact with the Canva application using the victim's authenticated session because an external origin could be loaded inside a privileged WebView (CWE-940). A threat actor who lures a user into loading a malicious page can send requests to Canva as the user, reading and modifying account data. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Stored cross-site scripting in the Ortto plugin for WordPress before 1.0.25 lets an attacker with the ability to change the plugin's configuration save unescaped values that execute as JavaScript in an administrator's browser when the affected settings page is opened. Successful exploitation requires a high-privilege WordPress account that can already write the plugin's settings (PR:H) plus a victim administrator who subsequently visits that page (UI:R), which keeps this at CVSS 4.8 (Medium) and a this_month patching priority. The vendor has released 1.0.25 as the fix; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Information disclosure in the Ortto plugin for WordPress before 1.0.25 exposes WooCommerce product passwords and private product metadata to anyone who loads an affected public storefront page, with no authentication or user interaction required (CVSS 5.3, confidentiality-only, CWE-201). The impact is bounded by the store's own content: only sites running Ortto alongside WooCommerce that actually hold password-protected products or private product metadata have sensitive data to leak, and integrity and availability are unaffected. No public exploit has been identified at time of analysis, and a vendor fix ships in version 1.0.25.
Opening a maliciously crafted Affinity document in Affinity by Canva builds prior to 3.3.1 can trigger an out-of-bounds read and dereference of an untrusted pointer, resulting in memory corruption or an application crash. Exploitation is file-based and local rather than remote: a victim must open the attacker-supplied document (UI:R) and the malformed raster data must reliably drive the fault across variable memory conditions, making attack complexity high and yielding only a CVSS 3.1 base score of 4.5 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L). No public exploit code exists and the issue is not confirmed actively exploited (it does not appear on CISA KEV); our assessment rates this a genuinely low-to-moderate priority memory-safety defect.
Heap memory disclosure and application crashes affect Affinity by Canva before version 3.3.1 (October 2026 release), where insufficient bounds checking on arrays of strings inside Affinity document files triggers a heap buffer over-read (CWE-126). Exploitation requires unauthenticated but local delivery: a victim must be socially engineered into opening a crafted Affinity document with the vulnerable application, which is consistent with the assessed vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/C:L/I:N/A:L and a low base score of 3.6. Impact is limited - any leaked heap contents are non-deterministic and bounded by heap layout (AC:H), and the most likely practical outcome is a client-side crash rather than reliable data theft; no public exploit identified at time of analysis.
Heap buffer over-read in Affinity by Canva versions before 3.3.1 (October 2026 release) allows an attacker to disclose small amounts of adjacent heap memory or crash the application when a user opens a specially crafted Affinity document containing a malformed, incomplete UTF-8 character sequence in its text. The flaw sits in the local document text parser and is rated low severity (CVSS 3.6, AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L): exploitation is local, requires the victim to open the malicious file, and is high-complexity because meaningful disclosure depends on heap layout, with integrity impact absent and only limited confidentiality/availability effects. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version (3.3.1) via its trust center advisory.
Heap-based buffer overflow in Affinity by Canva for macOS before 3.3.1 allows a crafted Affinity document to corrupt memory in the QuickLook thumbnail/preview extension the moment the file is displayed or its containing folder is browsed in Finder, causing the preview process to crash. The bug stems from an integer overflow in image-buffer size calculation when generating QuickLook thumbnails and previews (CWE-122), rated CVSS 4.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L); exploitation requires the malicious file to already be on local storage and demands precise crafting of size metadata plus heap grooming, so overall risk is low-to-moderate. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available in version 3.3.1.
Out-of-bounds heap read in Affinity by Canva for macOS before 3.3.1 (the October 2026 release) allows a crafted Affinity document to leak adjacent heap memory - including memory addresses - into the thumbnail or preview image that macOS QuickLook renders in Finder. Affected are users of the pre-3.3.1 macOS app whose QuickLook preview generator is registered with the OS; the victim only needs to select or browse to the malicious file in Finder, as automatic preview rendering triggers the bug without opening the document in the app. The issue is local-only with a high attack complexity (favorable heap layout required) and no authentication requirement (PR:N); it is not confirmed as actively exploited (no CISA KEV listing), no public exploit code was identified at time of analysis, and no EPSS score was supplied - consistent with its low assessed severity (CVSS 3.6) and its practical value as an information-leak primitive to chain with a separate vulnerability rather than a standalone compromise.
An out-of-bounds heap read in Affinity by Canva for macOS (before 3.3.1) lets a crafted Affinity document leak adjacent heap memory into the QuickLook thumbnail and preview images rendered by Finder, or crash the thumbnail/preview extension. The attack is local - the malicious file must already reside on the target Mac - and requires the victim to browse to or preview the file in Finder, which triggers the vulnerable code path; the disclosed bytes are non-deterministic, so an attacker cannot select what is exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the assessed severity is low (CVSS 3.1 base 2.9).
Opening a malformed Affinity document in Affinity by Canva versions before 3.3.1 (the October 2026 release) causes an out-of-bounds pointer dereference during file parsing, which crashes the desktop application. The attack requires user interaction (UI:R) to open the crafted file and a local vector (AV:L), so an attacker must rely on social engineering or a trusted-looking shared asset rather than any remote or automatic trigger. Impact is limited to availability (A:L) with no code execution, data disclosure, or integrity loss described, and no public exploit has been identified at time of analysis.
Double decoding in the Canva Desktop deeplink handler (versions before 1.125.0) lets an unauthenticated attacker who convinces a user to open a crafted custom-URI deeplink cause the application to load arbitrary same-origin content within that user's session. The flaw (CWE-174) yields limited integrity impact only, with no confidentiality or availability effect, and exploitation requires user interaction (UI:R). No public exploit code or confirmed active exploitation has been identified at time of analysis (no CISA KEV entry; no EPSS score supplied), and the vendor has released a fix in v1.125.0.
A type confusion vulnerability in the EMF (Enhanced Metafile) functionality of Canva Affinity allows attackers to achieve arbitrary code execution through specially crafted EMF files. The vulnerability affects Affinity version 3.0.1.3808 and requires user interaction to trigger, as victims must open a malicious EMF file. With a CVSS score of 7.8 and local attack vector, this represents a significant risk for users handling untrusted graphic files, though no active exploitation or public POC has been reported.
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file processing functionality, allowing attackers to read memory beyond allocated buffer boundaries. Affinity version 3.0.1.3808 and potentially earlier versions are affected. By crafting a malicious EMF file, an unauthenticated attacker with local file system access can trigger the vulnerability through user interaction (opening the file), potentially disclosing sensitive information such as API keys, credentials, or other data resident in adjacent memory regions. The vulnerability has a CVSS score of 6.1 indicating medium severity with high confidentiality impact but limited integrity and availability consequences.
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file handling functionality of Canva Affinity, allowing an attacker to read memory beyond allocated buffer boundaries by crafting a malicious EMF file. This vulnerability affects Canva Affinity version 3.0.1.3808 and potentially earlier versions, and requires user interaction (opening a specially crafted file) but no elevated privileges to exploit. Successful exploitation can disclose sensitive information from process memory, with potential for limited availability impact; no public exploit code or active exploitation in the wild has been confirmed based on available intelligence.
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, allowing an attacker to read memory beyond allocated buffer boundaries by supplying a specially crafted EMF file. Affected versions include Affinity 3.0.1.3808 and potentially other releases in the Affinity product line. Successful exploitation could disclose sensitive information from application memory, though the vulnerability does not enable code execution or denial of service; however, the local attack vector and user interaction requirement (opening a malicious file) limit real-world impact compared to network-exploitable vulnerabilities.
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity, affecting version 3.0.1.3808 and potentially earlier releases. An attacker can craft a malicious EMF file that, when opened by a user in Affinity, triggers an out-of-bounds memory read, potentially disclosing sensitive information from adjacent memory regions. The vulnerability requires user interaction (opening a file) but no elevated privileges, with a CVSS score of 6.1 indicating moderate severity; while not currently listed in CISA's Known Exploited Vulnerabilities catalog, the straightforward attack vector and information disclosure impact warrant prompt patching.
An out-of-bounds write vulnerability in Canva Affinity's EMF file processing allows attackers to achieve code execution by crafting malicious EMF (Enhanced Metafile) image files. The vulnerability affects Affinity version 3.0.1.3808 and requires user interaction to open the malicious file, but then grants full system compromise with high impact to confidentiality, integrity, and availability. No evidence of active exploitation or public proof-of-concept exists, and the local attack vector with user interaction requirement reduces immediate risk.
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file handling that allows attackers to read memory beyond allocated buffer boundaries. The vulnerability affects Affinity version 3.0.1.3808 and potentially other versions in the product line. An attacker can craft a malicious EMF file that, when opened by a user, triggers the out-of-bounds read to disclose sensitive information from process memory, with a CVSS score of 6.1 indicating moderate severity with high confidentiality impact and limited availability impact.
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file processing functionality, affecting Affinity 3.0.1.3808 and potentially other versions. An attacker can craft a malicious EMF file that, when opened by a user in Affinity, triggers an out-of-bounds memory read, allowing disclosure of sensitive information from adjacent memory regions. While the CVSS score of 6.1 indicates moderate severity with high confidentiality impact, actual exploitation requires user interaction (opening a file) and is limited to information disclosure without code execution capability.
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity, allowing attackers to read memory beyond allocated buffer boundaries when processing specially crafted EMF files. The vulnerability affects Canva Affinity version 3.0.1.3808 and potentially other versions in the product line; attackers with local access and user interaction can trigger the flaw to disclose sensitive information from process memory. While the CVSS score of 6.1 indicates medium severity with high confidentiality impact and low availability impact, the attack requires local file system access and user interaction (opening a malicious EMF file), limiting widespread exploitation risk.
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, affecting Affinity version 3.0.1.3808 and potentially other versions. An attacker can craft a malicious EMF file that, when opened by a user in Affinity, triggers an out-of-bounds memory read, potentially disclosing sensitive information from process memory. With a CVSS score of 6.1 and a local attack vector requiring user interaction, this vulnerability poses a moderate risk of information disclosure with minimal availability impact.
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, affecting Affinity version 3.0.1.3808 and potentially earlier versions. An attacker can craft a malicious EMF file that, when opened by a user in Affinity, triggers an out-of-bounds memory read, potentially disclosing sensitive information from the application's memory space. With a CVSS score of 6.1 and a local attack vector requiring user interaction, this vulnerability poses a moderate risk primarily through information disclosure, though local denial of service is also possible.
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file handling functionality, affecting Affinity version 3.0.1.3808 and potentially other versions. An attacker can craft a malicious EMF file that, when opened by a user in Affinity, triggers an out-of-bounds memory read, potentially disclosing sensitive information from process memory such as authentication tokens, cryptographic keys, or other confidential data. The vulnerability requires user interaction (opening a file) and local access, making it a moderate-priority issue with a CVSS base score of 6.1, though the high confidentiality impact warrants prompt patching.
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality that allows attackers to read memory beyond allocated buffer boundaries. Canva Affinity version 3.0.1.3808 and potentially earlier versions are affected. An attacker can craft a malicious EMF file that, when opened by a user, triggers the out-of-bounds read to disclose sensitive information from process memory; the vulnerability requires user interaction (opening the file) but no elevated privileges, making it a practical attack vector for phishing or drive-by downloads.
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity, allowing attackers to read memory beyond allocated buffer boundaries by crafting malicious EMF files. Affinity version 3.0.1.3808 and potentially earlier versions are affected. An attacker with local access can exploit this vulnerability through user interaction (opening a crafted EMF file) to disclose sensitive information from process memory, with potential for denial of service through application crashes.
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity, allowing attackers to read memory beyond allocated buffer boundaries through specially crafted EMF files. Affinity version 3.0.1.3808 and potentially earlier versions are affected, with the vulnerability requiring only local access and user interaction (opening a malicious file) to trigger. Successful exploitation enables disclosure of sensitive information from application memory, with potential limited impact on system availability; no active exploitation or public proof-of-concept has been confirmed at this time based on available intelligence sources.
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) image processing functionality of Canva Affinity, enabling attackers to read memory beyond allocated buffer boundaries through specially crafted EMF files. The vulnerability affects Canva Affinity version 3.0.1.3808 and potentially other versions, allowing unauthenticated local attackers with no special privileges to trigger the flaw via user interaction (opening a malicious file). Successful exploitation can disclose sensitive information from process memory, with a secondary risk of application instability (low availability impact). No active exploitation in the wild or public proof-of-concept has been confirmed based on available intelligence, but the vulnerability has been formally disclosed by Talos Intelligence and tracked in NIST NVD and ENISA EUVD databases.
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file handling functionality of Canva Affinity, allowing attackers to read memory beyond allocated buffer boundaries when processing specially crafted EMF files. The vulnerability affects Canva Affinity version 3.0.1.3808 and potentially other versions, requiring local access and user interaction (opening a malicious EMF file). Successful exploitation can lead to disclosure of sensitive information from process memory, with limited impact on system availability. No active exploitation in the wild has been confirmed via KEV status, and the CVSS 6.1 score reflects moderate risk balanced between high confidentiality impact and lower attack complexity.
Canva Affinity's EMF file parser is vulnerable to out-of-bounds read attacks when processing specially crafted files, allowing attackers to extract sensitive information from application memory. This local vulnerability requires user interaction to trigger and has no available patch, affecting users who open malicious EMF documents in Affinity.
Canva Affinity's EMF file parser is vulnerable to an out-of-bounds read (CWE-125) when processing specially crafted EMF files, allowing local attackers to extract sensitive data from application memory. This medium-severity vulnerability affects users who open untrusted EMF files and currently has no available patch. The attack requires user interaction and local access but poses a real information disclosure risk.
Unauthenticated configuration overwrite in the Ortto plugin for WordPress (versions before 1.0.25) lets a remote attacker rewrite the plugin's stored settings and turn the site into a delivery point for arbitrary scripts. The configuration-update request is never authenticated; the only gate is a secret that is exposed in public page HTML, so no credentials, user interaction, or non-default configuration is required on any site running an affected version. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the vendor has released a fix in 1.0.25 and the issue was reported by Canva, the plugin's maintainer.
Opening an attacker-crafted Affinity document in Affinity by Canva versions prior to 3.3.0 can trigger a stack-based buffer overflow that may lead to arbitrary code execution on the victim's endpoint. Exploitation is not remote or automatic: it requires the user to open the malformed document (UI:R) on a machine where Affinity is installed, and attack complexity is assessed as high (AC:H), reflecting the difficulty of turning the stack corruption into reliable code execution in the presence of modern stack and memory protections. No confirmed active exploitation (CISA KEV) and no public exploit code have been identified at the time of analysis, and the risk is genuine but not top-tier - it is confined to endpoints that handle untrusted Affinity files.
Session hijacking in the Canva Android App before version 2.376.0 arises from an unrestricted header-reflection flaw in a privileged WebView component. An attacker who can control an external origin loaded within that WebView receives sensitive HTTP headers - including session tokens - that the app fails to suppress, exposing the authenticated user's session and enabling full account takeover. No public exploit has been identified at time of analysis; the flaw is patched in v2.376.0 per the Canva trust advisory.
Session hijacking in the Canva Android App before 2.376.0 lets an attacker-controlled web page interact with the Canva application using the victim's authenticated session because an external origin could be loaded inside a privileged WebView (CWE-940). A threat actor who lures a user into loading a malicious page can send requests to Canva as the user, reading and modifying account data. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Stored cross-site scripting in the Ortto plugin for WordPress before 1.0.25 lets an attacker with the ability to change the plugin's configuration save unescaped values that execute as JavaScript in an administrator's browser when the affected settings page is opened. Successful exploitation requires a high-privilege WordPress account that can already write the plugin's settings (PR:H) plus a victim administrator who subsequently visits that page (UI:R), which keeps this at CVSS 4.8 (Medium) and a this_month patching priority. The vendor has released 1.0.25 as the fix; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Information disclosure in the Ortto plugin for WordPress before 1.0.25 exposes WooCommerce product passwords and private product metadata to anyone who loads an affected public storefront page, with no authentication or user interaction required (CVSS 5.3, confidentiality-only, CWE-201). The impact is bounded by the store's own content: only sites running Ortto alongside WooCommerce that actually hold password-protected products or private product metadata have sensitive data to leak, and integrity and availability are unaffected. No public exploit has been identified at time of analysis, and a vendor fix ships in version 1.0.25.
Opening a maliciously crafted Affinity document in Affinity by Canva builds prior to 3.3.1 can trigger an out-of-bounds read and dereference of an untrusted pointer, resulting in memory corruption or an application crash. Exploitation is file-based and local rather than remote: a victim must open the attacker-supplied document (UI:R) and the malformed raster data must reliably drive the fault across variable memory conditions, making attack complexity high and yielding only a CVSS 3.1 base score of 4.5 (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L). No public exploit code exists and the issue is not confirmed actively exploited (it does not appear on CISA KEV); our assessment rates this a genuinely low-to-moderate priority memory-safety defect.
Heap memory disclosure and application crashes affect Affinity by Canva before version 3.3.1 (October 2026 release), where insufficient bounds checking on arrays of strings inside Affinity document files triggers a heap buffer over-read (CWE-126). Exploitation requires unauthenticated but local delivery: a victim must be socially engineered into opening a crafted Affinity document with the vulnerable application, which is consistent with the assessed vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/C:L/I:N/A:L and a low base score of 3.6. Impact is limited - any leaked heap contents are non-deterministic and bounded by heap layout (AC:H), and the most likely practical outcome is a client-side crash rather than reliable data theft; no public exploit identified at time of analysis.
Heap buffer over-read in Affinity by Canva versions before 3.3.1 (October 2026 release) allows an attacker to disclose small amounts of adjacent heap memory or crash the application when a user opens a specially crafted Affinity document containing a malformed, incomplete UTF-8 character sequence in its text. The flaw sits in the local document text parser and is rated low severity (CVSS 3.6, AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L): exploitation is local, requires the victim to open the malicious file, and is high-complexity because meaningful disclosure depends on heap layout, with integrity impact absent and only limited confidentiality/availability effects. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed version (3.3.1) via its trust center advisory.
Heap-based buffer overflow in Affinity by Canva for macOS before 3.3.1 allows a crafted Affinity document to corrupt memory in the QuickLook thumbnail/preview extension the moment the file is displayed or its containing folder is browsed in Finder, causing the preview process to crash. The bug stems from an integer overflow in image-buffer size calculation when generating QuickLook thumbnails and previews (CWE-122), rated CVSS 4.9 (AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L); exploitation requires the malicious file to already be on local storage and demands precise crafting of size metadata plus heap grooming, so overall risk is low-to-moderate. No public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available in version 3.3.1.
Out-of-bounds heap read in Affinity by Canva for macOS before 3.3.1 (the October 2026 release) allows a crafted Affinity document to leak adjacent heap memory - including memory addresses - into the thumbnail or preview image that macOS QuickLook renders in Finder. Affected are users of the pre-3.3.1 macOS app whose QuickLook preview generator is registered with the OS; the victim only needs to select or browse to the malicious file in Finder, as automatic preview rendering triggers the bug without opening the document in the app. The issue is local-only with a high attack complexity (favorable heap layout required) and no authentication requirement (PR:N); it is not confirmed as actively exploited (no CISA KEV listing), no public exploit code was identified at time of analysis, and no EPSS score was supplied - consistent with its low assessed severity (CVSS 3.6) and its practical value as an information-leak primitive to chain with a separate vulnerability rather than a standalone compromise.
An out-of-bounds heap read in Affinity by Canva for macOS (before 3.3.1) lets a crafted Affinity document leak adjacent heap memory into the QuickLook thumbnail and preview images rendered by Finder, or crash the thumbnail/preview extension. The attack is local - the malicious file must already reside on the target Mac - and requires the victim to browse to or preview the file in Finder, which triggers the vulnerable code path; the disclosed bytes are non-deterministic, so an attacker cannot select what is exposed. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the assessed severity is low (CVSS 3.1 base 2.9).
Opening a malformed Affinity document in Affinity by Canva versions before 3.3.1 (the October 2026 release) causes an out-of-bounds pointer dereference during file parsing, which crashes the desktop application. The attack requires user interaction (UI:R) to open the crafted file and a local vector (AV:L), so an attacker must rely on social engineering or a trusted-looking shared asset rather than any remote or automatic trigger. Impact is limited to availability (A:L) with no code execution, data disclosure, or integrity loss described, and no public exploit has been identified at time of analysis.
Double decoding in the Canva Desktop deeplink handler (versions before 1.125.0) lets an unauthenticated attacker who convinces a user to open a crafted custom-URI deeplink cause the application to load arbitrary same-origin content within that user's session. The flaw (CWE-174) yields limited integrity impact only, with no confidentiality or availability effect, and exploitation requires user interaction (UI:R). No public exploit code or confirmed active exploitation has been identified at time of analysis (no CISA KEV entry; no EPSS score supplied), and the vendor has released a fix in v1.125.0.
A type confusion vulnerability in the EMF (Enhanced Metafile) functionality of Canva Affinity allows attackers to achieve arbitrary code execution through specially crafted EMF files. The vulnerability affects Affinity version 3.0.1.3808 and requires user interaction to trigger, as victims must open a malicious EMF file. With a CVSS score of 7.8 and local attack vector, this represents a significant risk for users handling untrusted graphic files, though no active exploitation or public POC has been reported.
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file processing functionality, allowing attackers to read memory beyond allocated buffer boundaries. Affinity version 3.0.1.3808 and potentially earlier versions are affected. By crafting a malicious EMF file, an unauthenticated attacker with local file system access can trigger the vulnerability through user interaction (opening the file), potentially disclosing sensitive information such as API keys, credentials, or other data resident in adjacent memory regions. The vulnerability has a CVSS score of 6.1 indicating medium severity with high confidentiality impact but limited integrity and availability consequences.
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file handling functionality of Canva Affinity, allowing an attacker to read memory beyond allocated buffer boundaries by crafting a malicious EMF file. This vulnerability affects Canva Affinity version 3.0.1.3808 and potentially earlier versions, and requires user interaction (opening a specially crafted file) but no elevated privileges to exploit. Successful exploitation can disclose sensitive information from process memory, with potential for limited availability impact; no public exploit code or active exploitation in the wild has been confirmed based on available intelligence.
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, allowing an attacker to read memory beyond allocated buffer boundaries by supplying a specially crafted EMF file. Affected versions include Affinity 3.0.1.3808 and potentially other releases in the Affinity product line. Successful exploitation could disclose sensitive information from application memory, though the vulnerability does not enable code execution or denial of service; however, the local attack vector and user interaction requirement (opening a malicious file) limit real-world impact compared to network-exploitable vulnerabilities.
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity, affecting version 3.0.1.3808 and potentially earlier releases. An attacker can craft a malicious EMF file that, when opened by a user in Affinity, triggers an out-of-bounds memory read, potentially disclosing sensitive information from adjacent memory regions. The vulnerability requires user interaction (opening a file) but no elevated privileges, with a CVSS score of 6.1 indicating moderate severity; while not currently listed in CISA's Known Exploited Vulnerabilities catalog, the straightforward attack vector and information disclosure impact warrant prompt patching.
An out-of-bounds write vulnerability in Canva Affinity's EMF file processing allows attackers to achieve code execution by crafting malicious EMF (Enhanced Metafile) image files. The vulnerability affects Affinity version 3.0.1.3808 and requires user interaction to open the malicious file, but then grants full system compromise with high impact to confidentiality, integrity, and availability. No evidence of active exploitation or public proof-of-concept exists, and the local attack vector with user interaction requirement reduces immediate risk.
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file handling that allows attackers to read memory beyond allocated buffer boundaries. The vulnerability affects Affinity version 3.0.1.3808 and potentially other versions in the product line. An attacker can craft a malicious EMF file that, when opened by a user, triggers the out-of-bounds read to disclose sensitive information from process memory, with a CVSS score of 6.1 indicating moderate severity with high confidentiality impact and limited availability impact.
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file processing functionality, affecting Affinity 3.0.1.3808 and potentially other versions. An attacker can craft a malicious EMF file that, when opened by a user in Affinity, triggers an out-of-bounds memory read, allowing disclosure of sensitive information from adjacent memory regions. While the CVSS score of 6.1 indicates moderate severity with high confidentiality impact, actual exploitation requires user interaction (opening a file) and is limited to information disclosure without code execution capability.
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity, allowing attackers to read memory beyond allocated buffer boundaries when processing specially crafted EMF files. The vulnerability affects Canva Affinity version 3.0.1.3808 and potentially other versions in the product line; attackers with local access and user interaction can trigger the flaw to disclose sensitive information from process memory. While the CVSS score of 6.1 indicates medium severity with high confidentiality impact and low availability impact, the attack requires local file system access and user interaction (opening a malicious EMF file), limiting widespread exploitation risk.
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, affecting Affinity version 3.0.1.3808 and potentially other versions. An attacker can craft a malicious EMF file that, when opened by a user in Affinity, triggers an out-of-bounds memory read, potentially disclosing sensitive information from process memory. With a CVSS score of 6.1 and a local attack vector requiring user interaction, this vulnerability poses a moderate risk of information disclosure with minimal availability impact.
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality, affecting Affinity version 3.0.1.3808 and potentially earlier versions. An attacker can craft a malicious EMF file that, when opened by a user in Affinity, triggers an out-of-bounds memory read, potentially disclosing sensitive information from the application's memory space. With a CVSS score of 6.1 and a local attack vector requiring user interaction, this vulnerability poses a moderate risk primarily through information disclosure, though local denial of service is also possible.
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file handling functionality, affecting Affinity version 3.0.1.3808 and potentially other versions. An attacker can craft a malicious EMF file that, when opened by a user in Affinity, triggers an out-of-bounds memory read, potentially disclosing sensitive information from process memory such as authentication tokens, cryptographic keys, or other confidential data. The vulnerability requires user interaction (opening a file) and local access, making it a moderate-priority issue with a CVSS base score of 6.1, though the high confidentiality impact warrants prompt patching.
An out-of-bounds read vulnerability exists in Canva Affinity's EMF (Enhanced Metafile) file parsing functionality that allows attackers to read memory beyond allocated buffer boundaries. Canva Affinity version 3.0.1.3808 and potentially earlier versions are affected. An attacker can craft a malicious EMF file that, when opened by a user, triggers the out-of-bounds read to disclose sensitive information from process memory; the vulnerability requires user interaction (opening the file) but no elevated privileges, making it a practical attack vector for phishing or drive-by downloads.
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity, allowing attackers to read memory beyond allocated buffer boundaries by crafting malicious EMF files. Affinity version 3.0.1.3808 and potentially earlier versions are affected. An attacker with local access can exploit this vulnerability through user interaction (opening a crafted EMF file) to disclose sensitive information from process memory, with potential for denial of service through application crashes.
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file parsing functionality of Canva Affinity, allowing attackers to read memory beyond allocated buffer boundaries through specially crafted EMF files. Affinity version 3.0.1.3808 and potentially earlier versions are affected, with the vulnerability requiring only local access and user interaction (opening a malicious file) to trigger. Successful exploitation enables disclosure of sensitive information from application memory, with potential limited impact on system availability; no active exploitation or public proof-of-concept has been confirmed at this time based on available intelligence sources.
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) image processing functionality of Canva Affinity, enabling attackers to read memory beyond allocated buffer boundaries through specially crafted EMF files. The vulnerability affects Canva Affinity version 3.0.1.3808 and potentially other versions, allowing unauthenticated local attackers with no special privileges to trigger the flaw via user interaction (opening a malicious file). Successful exploitation can disclose sensitive information from process memory, with a secondary risk of application instability (low availability impact). No active exploitation in the wild or public proof-of-concept has been confirmed based on available intelligence, but the vulnerability has been formally disclosed by Talos Intelligence and tracked in NIST NVD and ENISA EUVD databases.
An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) file handling functionality of Canva Affinity, allowing attackers to read memory beyond allocated buffer boundaries when processing specially crafted EMF files. The vulnerability affects Canva Affinity version 3.0.1.3808 and potentially other versions, requiring local access and user interaction (opening a malicious EMF file). Successful exploitation can lead to disclosure of sensitive information from process memory, with limited impact on system availability. No active exploitation in the wild has been confirmed via KEV status, and the CVSS 6.1 score reflects moderate risk balanced between high confidentiality impact and lower attack complexity.
Canva Affinity's EMF file parser is vulnerable to out-of-bounds read attacks when processing specially crafted files, allowing attackers to extract sensitive information from application memory. This local vulnerability requires user interaction to trigger and has no available patch, affecting users who open malicious EMF documents in Affinity.
Canva Affinity's EMF file parser is vulnerable to an out-of-bounds read (CWE-125) when processing specially crafted EMF files, allowing local attackers to extract sensitive data from application memory. This medium-severity vulnerability affects users who open untrusted EMF files and currently has no available patch. The attack requires user interaction and local access but poses a real information disclosure risk.