CVE-2026-81546 is a stack-based buffer overflow vulnerability in Affinity by Canva prior to version 3.3.0. The flaw arises from insufficient bounds checking during the parsing of Affinity document files. Exploitation requires a user to open a specially crafted document, potentially allowing an attacker to execute arbitrary code with user-level privileges. The vulnerability has a CVSS 3.1 base score of 7.7, indicating high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, and the vulnerability requires local attack vector with high attack complexity and user interaction.

Successful exploitation can lead to arbitrary code execution in the context of the user opening the malicious document. This impacts confidentiality, integrity, and availability of the affected system. The attack requires user interaction and has a high attack complexity, limiting ease of exploitation. There are no reports of active exploitation in the wild at this time.

A fixed version 3.3.0 or later is implied but not explicitly confirmed in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until patched, users should avoid opening untrusted Affinity document files and apply standard security best practices to limit exposure.