An out‑of‑bounds write flaw exists in the EMF handling of Canva Affinity. A maliciously crafted EMF file can trigger the vulnerability, allowing an attacker to corrupt memory and potentially execute arbitrary code. The weakness is classified as CWE‑787 (Improper Bounds Checking).

The vulnerability affects the Canva Affinity product running on Windows. Version information was not provided by the CNA; therefore, all current releases of Canva Affinity on Windows are potentially impacted until an official fix is distributed.

The CVSS score of 7.8 indicates a high severity impact. The EPSS score of less than 1% suggests a low current likelihood of exploitation observed in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local or user‑initiated file processing, as the issue is triggered when a specially crafted EMF file is loaded by the application. Exploitation would therefore require the victim to open or otherwise process such a file, potentially enabling an attacker to run arbitrary code on the affected system.