An out‑of‑bounds read vulnerability (CWE‑125) exists in the EMF functionality of Canva Affinity. Exploiting the vulnerability by opening a specially crafted EMF file can cause the application to read memory beyond the intended bounds, potentially revealing sensitive information to the attacker. The CVE description states the primary impact is disclosure of sensitive data.

Canva Affinity running on Windows is affected, as identified by the CPE cpe:2.3:a:canva:affinity:*:*:*:*:*:windows:*:*. No specific affected version numbers are listed in the CVE data, so administrators should verify whether their installed version is on the affected release line using vendor documentation.

The CVSS score of 6.1 indicates moderate risk, while the EPSS score of less than 1% suggests a low probability of exploitation in the near term. The vulnerability is not listed in CISA's KEV catalog. It is triggered by opening a malicious EMF file, so the likely attack vector is a file‑based local or remote delivery. Exploitation requires the victim to run Canva Affinity and open the crafted file, making it mitigable by restricting file opening from untrusted sources and applying any available patch.