Description
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.
Published: 2026-10-09
Score: 3.6 Low
EPSS: < 1% Very Low
KEV: No
Impact: Heap buffer over-read
Action: Patch upgrade
AI Analysis

Impact

The Affinity by Canva application, prior to version 3.3.1, fails to perform adequate bounds checking when parsing arrays of strings in document files, leading to a heap buffer over‑read. An attacker can craft a malicious Affinity document that, when opened by a user, may expose adjacent heap memory contents or cause the application to crash. The weakness is a classic buffer over-read (CWE‑126).

Affected Systems

Canva Affinity users running any version before 3.3.1, released in October 2026. The vulnerability is specific to the Affinity application; no other products are affected.

Risk and Exploitability

The CVSS score of 3.6 indicates a low severity issue, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The exploit requires a crafted document be opened by a user, so it is a local-privilege or user-interaction vector and does not lead to remote code execution. The risk is limited to potential data exposure or denial of service in affected installations.

Generated by OpenCVE AI on October 9, 2026 at 15:56 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Affinity to version 3.3.1 or later.
  • Verify that Affinity documents are from trusted sources before opening them.
  • Instruct users to avoid opening unknown Affinity documents until a patch is applied.

Generated by OpenCVE AI on October 9, 2026 at 15:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Title Heap Buffer Over-Read in Affinity Document Parsing

Fri, 09 Oct 2026 13:15:00 +0000

Type Values Removed Values Added
Description The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.
First Time appeared Canva
Canva affinity
Weaknesses CWE-126
CPEs cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*
Vendors & Products Canva
Canva affinity
References
Metrics cvssV3_1

{'score': 3.6, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L'}

Subscriptions

Canva Affinity
cve-icon MITRE

Status: PUBLISHED

Assigner: Canva

Published:

Updated: 2026-10-09T16:46:54.098Z

Reserved: 2026-09-28T07:12:04.980Z

Link: CVE-2026-101130

cve-icon Vulnrichment

Updated: 2026-10-09T16:15:31.796Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-09T13:17:07.037

Modified: 2026-10-09T17:16:43.397

Link: CVE-2026-101130

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T16:00:10Z

Weaknesses