CVE-2025-61952 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile) processing functionality of Canva Affinity version 3.0.1.3808. Exploitation requires a user to open a specially crafted EMF file, which triggers the vulnerability and may lead to disclosure of sensitive information. The vulnerability does not allow code execution or integrity compromise but can leak confidential data. It has a CVSS score of 6.1, indicating medium severity, with low attack complexity and no privileges required, but user interaction is necessary. There are no known exploits in the wild at this time, and no patches have been released yet. Organizations using Canva Affinity for graphic design should be cautious when handling untrusted EMF files.
CVE-2025-66503 is an out-of-bounds read vulnerability in the EMF processing functionality of Canva Affinity version 3.0.1.3808. An attacker can exploit this by crafting a malicious EMF file that, when opened by the vulnerable software, causes an out-of-bounds read potentially leading to sensitive information disclosure. The vulnerability requires local access (attack vector: local), no privileges, but does require user interaction to open the malicious file. The CVSS score is 6.1 (medium severity), reflecting high confidentiality impact but no integrity or significant availability impact. No known exploits are currently reported in the wild. Organizations using Canva Affinity for graphic design should be aware of this risk and apply patches once available or implement strict file handling policies.
CVE-2025-66042 is an out-of-bounds read vulnerability in the EMF processing functionality of Canva Affinity version 3.0.1.3808. An attacker can exploit this by crafting a malicious EMF file that, when opened, causes the software to read memory outside of its intended bounds. This can lead to the disclosure of sensitive information from the affected system. The vulnerability requires local access and user interaction to open the malicious file but does not require privileges or authentication. The CVSS score is 6.1, indicating a medium severity with high confidentiality impact but no integrity or significant availability impact. No known exploits are currently in the wild, and no patches have been released yet.
CVE-2025-65119 is an out-of-bounds read vulnerability in the EMF functionality of Canva Affinity version 3.0.1.3808. An attacker can exploit this by providing a specially crafted EMF file, causing the application to read memory beyond its intended boundaries. This can lead to the disclosure of sensitive information without requiring privileges but does require user interaction to open the malicious file. The vulnerability has a CVSS score of 6.1, indicating medium severity, with high impact on confidentiality but no impact on integrity and low impact on availability. No known exploits are currently reported in the wild. Organizations using Canva Affinity should be cautious when handling EMF files and monitor for updates or patches.
CVE-2025-62403 is an out-of-bounds read vulnerability in the EMF processing functionality of Canva Affinity version 3.0.1.3808. An attacker can exploit this by crafting a malicious EMF file that triggers the vulnerability, potentially leading to unauthorized disclosure of sensitive information. The vulnerability requires local access and user interaction to open the malicious file but does not require privileges or authentication. The CVSS score is 6.1, indicating a medium severity level, with high confidentiality impact but no integrity or significant availability impact. No known exploits are currently reported in the wild. Organizations using Canva Affinity should be cautious when handling EMF files from untrusted sources and monitor for updates or patches from the vendor.
CVE-2026-20726 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile) processing functionality of Canva Affinity version 3.0.1.3808. An attacker can exploit this by crafting a malicious EMF file that, when opened or processed by the affected software, causes the application to read memory outside the intended bounds. This can lead to disclosure of sensitive information from the application's memory space. The vulnerability requires local access (attack vector: local), no privileges, but does require user interaction to open the malicious file. The CVSS 3.1 base score is 6.1, indicating a medium severity level, with high confidentiality impact but no integrity or significant availability impact.
CVE-2026-22882 is an out-of-bounds read vulnerability in the EMF processing functionality of Canva Affinity version 3.0.1.3808. An attacker can exploit this by crafting a malicious EMF file that, when opened, causes the application to read memory outside the intended buffer boundaries. This can lead to disclosure of sensitive information from the application's memory. The vulnerability requires local access (attack vector: local) and user interaction to open the malicious file. It does not require privileges or authentication. The CVSS score is 6.1 (medium severity) with high confidentiality impact but no integrity or availability impact.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Canva Canva – Design beautiful blog graphics allows Reflected XSS.This issue affects Canva – Design beautiful blog graphics: from n/a through 1.2.4.