The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and the dereference of an untrusted pointer. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in memory corruption or an application crash.
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could corrupt heap memory and cause the thumbnail or preview extension to crash.
The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory, including memory addresses, in the rendered thumbnail or preview image.
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory in the rendered thumbnail or preview image, or cause the thumbnail or preview extension to crash.
The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in an application crash.
CVE-2026-81546 is a stack-based buffer overflow vulnerability in the Affinity by Canva application prior to version 3.3.0. The vulnerability arises from inadequate bounds checking when parsing Affinity document files. An attacker could craft a malicious document that, when opened by a user, may lead to arbitrary code execution. This vulnerability has a high severity rating with a CVSS score of 7.7.
CVE-2025-66342 is a high-severity type confusion vulnerability in the EMF processing functionality of Canva Affinity version 3.0.1.3808. An attacker can craft a malicious EMF file that, when opened or processed by the vulnerable software, triggers memory corruption leading to arbitrary code execution. Exploitation requires local access and user interaction, but no privileges are needed. The vulnerability impacts confidentiality, integrity, and availability due to potential full system compromise. No known exploits are currently in the wild, and no patches have been released yet. Organizations using Canva Affinity for graphic design should be cautious when handling EMF files from untrusted sources. Mitigation involves restricting EMF file handling, applying vendor patches once available, and employing endpoint protection with behavior monitoring.
CVE-2025-62500 is an out-of-bounds read vulnerability in the EMF processing functionality of Canva Affinity version 3.0.1.3808. An attacker can exploit this by crafting a malicious EMF file that, when opened, causes the application to read memory outside its intended bounds. This can lead to disclosure of sensitive information from the process memory. The vulnerability requires local access and user interaction to open the malicious file but does not require privileges or authentication. The CVSS score is 6.1, indicating a medium severity level. No known exploits are currently reported in the wild.
CVE-2025-61979 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile) processing functionality of Canva Affinity version 3.0.1.3808. An attacker can exploit this by crafting a malicious EMF file that triggers an out-of-bounds read, potentially leaking sensitive information from memory. The vulnerability requires local access and user interaction to open the malicious file but does not require privileges or authentication. The CVSS score of 6.1 reflects a medium severity, primarily due to the confidentiality impact and limited attack vector. No known exploits are currently reported in the wild, and no patches have been published yet. Organizations using Canva Affinity for graphic design should be cautious when handling untrusted EMF files.
CVE-2025-64733 is an out-of-bounds read vulnerability in the EMF processing functionality of Canva Affinity version 3.0.1.3808. An attacker can exploit this by crafting a malicious EMF file that triggers the vulnerability, potentially leading to disclosure of sensitive information. The vulnerability requires local access and user interaction to open the malicious file. It does not allow code execution or system integrity compromise but can leak confidential data. No known exploits are currently in the wild. The CVSS score is 6.1 (medium severity), reflecting the moderate impact and exploitation complexity.
CVE-2025-66000 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile) processing functionality of Canva Affinity version 3.0.1.3808. An attacker can exploit this by crafting a malicious EMF file that triggers the vulnerability, potentially causing disclosure of sensitive information from memory. The vulnerability requires local access and user interaction to open the malicious file, but does not require privileges or authentication. The CVSS score is 6.1 (medium severity), reflecting high confidentiality impact with limited integrity and availability impact. No known exploits are currently reported in the wild. Organizations using Canva Affinity for graphic design should be aware of this risk and apply mitigations to prevent sensitive data leakage.
CVE-2025-64301 is a high-severity out-of-bounds write vulnerability in the EMF functionality of Canva Affinity version 3.0.1.3808. An attacker can exploit this by crafting a malicious EMF file that triggers an out-of-bounds write, potentially leading to arbitrary code execution. The vulnerability requires local access and user interaction to open the malicious file but does not require privileges or authentication. This flaw impacts confidentiality, integrity, and availability, making it critical for affected users to apply mitigations promptly. No known exploits are currently in the wild, but the risk remains significant due to the potential for remote code execution. Organizations using Canva Affinity in creative and design workflows should prioritize patching once available and implement strict file handling policies. Countries with significant usage of Canva Affinity and high-value creative industries are at greater risk.
CVE-2025-64776 is an out-of-bounds read vulnerability in the EMF functionality of Canva Affinity version 3.0.1.3808. An attacker can exploit this by crafting a malicious EMF file that triggers the vulnerability, potentially leading to disclosure of sensitive information. The vulnerability requires local access and user interaction to open the malicious file. It does not allow code execution or system integrity compromise but can leak confidential data. No known exploits are currently in the wild, and no patches have been released yet. The CVSS score is 6.1 (medium severity), reflecting the moderate risk due to required user interaction and local attack vector.
CVE-2025-64735 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile) processing functionality of Canva Affinity version 3.0.1.3808. An attacker can exploit this by crafting a malicious EMF file that, when opened or processed by the affected software, causes an out-of-bounds read. This can lead to the disclosure of sensitive information from the application's memory. The vulnerability requires local access (attack vector: local), no privileges, and user interaction to trigger. It does not allow code execution or integrity compromise but can leak confidential data. No known exploits are currently in the wild, and no patches have been published yet. The CVSS score is 6.
CVE-2025-66633 is an out-of-bounds read vulnerability in the EMF processing functionality of Canva Affinity version 3.0.1.3808. An attacker can exploit this by crafting a malicious EMF file that, when opened, causes the application to read memory beyond its intended bounds. This can lead to the disclosure of sensitive information from the application's memory space. The vulnerability requires local access to the system and user interaction to open the malicious file. It does not require privileges or authentication but has a medium severity CVSS score of 6.1. No known exploits are currently in the wild, and no patches have been published yet.
CVE-2025-58427 is an out-of-bounds read vulnerability in the EMF processing functionality of Canva Affinity version 3.0.1.3808. An attacker can exploit this by crafting a malicious EMF file that triggers the vulnerability, potentially leading to disclosure of sensitive information. The vulnerability requires local access and user interaction to open the malicious file. It does not allow code execution or system integrity compromise but can leak confidential data. No known exploits are currently in the wild, and no patches have been released yet. The CVSS score is 6.1 (medium severity), reflecting the moderate impact and exploitation complexity.
CVE-2025-66617 is an out-of-bounds read vulnerability in the EMF functionality of Canva Affinity version 3.0.1.3808. An attacker can exploit this by crafting a malicious EMF file that triggers the vulnerability, potentially leading to the disclosure of sensitive information. The vulnerability requires local access and user interaction to open the malicious file. It does not allow code execution or system integrity compromise but can leak confidential data. No known exploits are currently reported in the wild. The CVSS score is 6.1 (medium severity), reflecting the moderate impact and exploitation complexity.
CVE-2025-47873 is an out-of-bounds read vulnerability in the EMF processing functionality of Canva Affinity version 3.0.1.3808. An attacker can exploit this by crafting a malicious EMF file that triggers the vulnerability, potentially leading to unauthorized disclosure of sensitive information. The vulnerability requires local access and user interaction to open the malicious file but does not require privileges or authentication. The CVSS score is 6.1 (medium severity), reflecting high confidentiality impact but limited integrity and availability impact. No known exploits are currently reported in the wild. Organizations using Canva Affinity for graphic design should be aware of this vulnerability and apply patches once available or implement mitigations to reduce risk.