The vulnerability is an out‑of‑bounds read in the EMF (Enhanced Metafile) processing of Canva Affinity. When the application parses a maliciously crafted EMF file, it accesses memory outside the intended buffer, which can expose secrets such as passwords, in‑process data, or other sensitive information that resides adjacent in memory. The weakness corresponds to CWE‑125, indicating a flaw in bounds checking that compromises data confidentiality.

The affected product is Canva Affinity, identified by the vendor Affinity. The product’s CPE is cpe:2.3:a:canva:affinity:*:*:*:*:*:windows:*:*. No specific version information was disclosed; therefore, any running instance of this application is potentially vulnerable until a vendor‑issued fix is applied.

The CVSS score is 6.1, indicating moderate severity. EPSS is below 1%, suggesting limited likelihood of widespread exploitation, and it is not listed in the CISA KEV catalog. The primary attack vector is local: a user must open the crafted EMF file with the application, so the risk is confined to environments where the file is processed by an authenticated or local user. Nonetheless, preventing exposure of sensitive data remains the key concern.