A type confusion flaw has been identified in the EMF processing routine of Canva Affinity. When the application parses a specially crafted EMF file, the mismatch in expected data types can cause memory corruption, enabling an attacker to execute arbitrary code on the affected system. The vulnerability is rooted in CWE-843, which denotes Data Type Confusion, and the vendor’s description confirms that the result can lead to code execution.

The affected product is Canva Affinity, running on Windows platforms as indicated by the CPE string. Specific version information is not supplied by the CVE data, so all installations of Canva Affinity may be vulnerable until an update is deployed.

The CVSS score is 7.8, indicating high severity. The EPSS score is less than 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not currently listed in CISA’s KEV catalog. Based on the nature of the flaw and the fact that it requires a crafted EMF file, the likely attack vector is local: the attacker would need to deliver or trick the victim into opening the malicious file. If the file is processed remotely by a web component, a remote vector could also be possible, but this is inferred rather than stated in the input.