An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. An attacker that supplies a specially crafted EMF file can trigger the vulnerability, allowing a read beyond the intended memory bounds which can expose sensitive data. The weakness is identified as CWE-125 (Out-of-Bounds Read) and has a CVSS score of 6.1, indicating a moderate impact on confidentiality.

The affected product is Canva Affinity, as identified by the CNA and the CPE string cpe:2.3:a:canva:affinity:*:*:*:*:*:windows:*:*. No specific version information is provided in the CNA data, so all released versions of Canva Affinity for Windows may be susceptible until a patch is issued.

The CVE has an EPSS score of less than 1% and is not listed in the CISA KEV catalog, suggesting a low likelihood of exploitation in the wild. The vulnerability can be triggered by a specially crafted EMF file, implying that the likely attack vector is local or through a user-supplied file. No public exploit code is currently known, but the moderate CVSS score underscores that the privilege to read sensitive data is a significant concern if the vector is leveraged.