Affinity by Canva did not handle incomplete UTF-8 character sequences correctly when parsing text in document files. The resulting heap buffer over‑read allows an attacker to craft a malicious document that, when opened, can cause the application to crash or leak data stored in adjacent memory regions. The disclosure would be limited to data contained in the application’s heap at the time of parsing and does not grant broader system access.

Canva’s Affinity graphics editor versions earlier than 3.3.1 (released in October 2026) are vulnerable. Updates to 3.3.1 or later contain the fix and are unaffected.

The CVSS score of 3.6 indicates low severity. EPSS information is not available and the vulnerability is not listed in the KEV catalog, suggesting it has not yet been publicly exploited or weaponized. The likely attack vector involves a local user opening a specially crafted Affinity document; remote exploitation or network-based attacks are not supported by the description.