An out‑of‑bounds read vulnerability in Canva Affinity's EMF functionality can allow an attacker to read data beyond the intended bounds during EMF file processing. This weakness, classified as CWE‑125, may lead to the disclosure of sensitive information that the user has access to on the system, including potentially private data contained in the affected memory region.

The vulnerability affects Canva Affinity running on Windows. No specific affected versions are listed in the provided data, so any installation of the product on Windows could be potentially impacted until a vendor update is released.

The CVSS score of 6.1 indicates moderate severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves an attacker supplying a specially crafted EMF file to a user of Canva Affinity, though the exact session or privilege requirements are not specified in the data, so this is inferred rather than explicitly stated.