Affinity by Canva performs insufficient bounds checking while parsing raster image data in Affinity document files. This flaw allows a crafted document to trigger an out‑of‑bounds read and dereference an untrusted pointer, which can corrupt memory or cause the application to crash. The effect is a denial‑of‑service or potential compromise if the corruption leads to further exploitation, but the description limits the impact to memory corruption or crash.

The vulnerability affects all versions of Affinity by Canva earlier than 3.3.1, released October 2026. Users running those earlier releases remain susceptible. The flaw is tied to the Affinity product and is not limited to a specific operating system or deployment scenario, making all users of the affected application vulnerable.

With a CVSS score of 4.5, the flaw has moderate severity. EPSS information is unavailable, and the vulnerability is not catalogued in the CISA KEV, indicating no known widespread exploitation. The likely attack vector is local; an attacker must supply a malicious Affinity document that a user opens or imports. Because the flaw results in memory corruption or a crash rather than immediate code execution, the immediate threat is primarily a denial‑of‑service condition.