CVE-2025-64776 is an out-of-bounds read vulnerability in the EMF functionality of Canva Affinity. The vulnerability allows an attacker to read memory beyond the intended bounds, potentially exposing sensitive information. It represents a classic buffer overread weakness as defined by CWE-125.

The affected product is Canva Affinity, as indicated by the vendor name and the CPE string cpe:2.3:a:canva:affinity:*:*:*:*:*:windows:*:*. No specific version information is provided in the CVE entry.

The CVSS score of 6.1 indicates a moderate severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can exploit this weakness by supplying a specially crafted EMF file to the application, which will trigger an out-of-bounds read. The attack would require the victim to open or process the malicious EMF file, implying a local or file-wise attack vector.