CVE-2026-101130: CWE-126 Buffer Over-read in canva affinity

CVE-2026-101130 is a heap buffer over-read vulnerability in Affinity by Canva prior to version 3.3.1. The issue arises from insufficient bounds checking when parsing arrays of strings in Affinity document files. An attacker can craft a malicious document that, when opened, may disclose adjacent heap memory contents in the document's text or cause an application crash. The CVSS 3.1 base score is 3.6, reflecting low severity with local attack vector, high attack complexity, no privileges required, and user interaction needed.

Successful exploitation can lead to disclosure of adjacent heap memory contents, potentially exposing sensitive information within the application memory. Additionally, the vulnerability can cause the application to crash, resulting in denial of service. There is no indication of integrity or broader availability impact beyond the application crash. No known exploits are reported in the wild.

A fix is available in Affinity by Canva version 3.3.1 and later. Users should upgrade to version 3.3.1 or newer to remediate this vulnerability. No additional mitigation steps are indicated.