An out-of-bounds read vulnerability exists in the EMF handling of Canva Affinity. The flaw allows an attacker to supply a specially crafted EMF file that forces the application to read beyond intended memory bounds, potentially exposing sensitive data from the victim’s memory. The vulnerability is identified as CWE-125 Evidence of a classic buffer-read-to-out-of-bounds exploit that could, without further privileges, leak confidential information. This information disclosure does not provide direct code execution or privilege escalation but can still be leveraged to harvest data from the victim’s session.

The affected product is Canva Affinity, available on Windows platforms. The vulnerability applies to any installation of this application that processes EMF files, regardless of version, as no specific version constraints are stated in the CNA data.

The CVSS v3 score of 6.1 indicates a moderate severity. The EPSS probability is below 1%, suggesting that widespread exploitation is unlikely. The issue is not listed in the CISA KEV catalog, further indicating a low exploitation rate. The attack vector is inferred to be user-mediated via a malicious EMF file; an attacker would need to deliver or lure the user to open a crafted file in the application. Once opened, the read vulnerability can reveal memory contents but does not grant code execution or elevate privileges, limiting the overall impact to data leakage.