An out-of-bounds read vulnerability (CWE-125) exists in the EMF (Enhanced Metafile) handling code of Canva Affinity. The flaw allows a specially crafted EMF file to cause the application to read beyond allocated memory boundaries, potentially exposing sensitive data stored in memory. The vulnerability does not grant execution of code or denial of service; it primarily facilitates data disclosure.

The vulnerable product is Canva Affinity for Windows, identified by the CPE string cpe:2.3:a:canva:affinity:*:*:*:*:*:windows:*:*. Specific version ranges are not provided, implying that any installation of Affinity with the affected EMF functionality on Windows could be susceptible.

The CVSS score of 6.1 indicates a medium severity level, while the EPSS score of less than 1% suggests a low likelihood of real-world exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is most likely the delivery of a malicious EMF file to the target system; the attacker must compel the file to be opened or processed by Affinity, which could occur through social engineering or legitimate import mechanisms. The impact is limited to potential information disclosure rather than code execution or system crash.