An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) functionality of Canva Affinity. A specially crafted EMF file can trigger the flaw, enabling an attacker to read memory beyond the intended bounds. This weakness corresponds to CWE-125, which allows the disclosure of potentially sensitive information from the process memory. If exploited, an attacker could gain access to confidential data held by the application or the underlying operating system.

The affected system is Canva Affinity on Windows platforms. Specific version details are not disclosed in the provided information, so all installations of Affinity that still rely on the legacy EMF processing code are potentially vulnerable. The vulnerability is listed under the cpe:2.3:a:canva:affinity:*:*:*:*:*:windows:*:* which indicates Windows as the target OS.

CVSS score 6.1 indicates a medium severity impact. The EPSS score of <1% suggests a low probability of exploitation in the wild. The vulnerability is not included in the CISA KEV list. The likely attack vector requires an attacker to supply a malicious EMF file that the victim opens, thus the exploit is most effective when users download or otherwise receive a manipulated file. No public exploit code has been disclosed, but the flaw can be leveraged by attackers familiar with EMF file structure.