The vulnerability in Affinity by Canva before version 3.3.1 allows a malicious party to construct a specially crafted Affinity document that, when opened, bypasses bounds checking during file parsing and causes an out‑of‑bounds pointer dereference. The result is a crash of the Affinity application, denying the user’s ability to work with the files but not exposing data or executing arbitrary code.

Canva Affinity users running any version earlier than 3.3.1 are affected. The vendor is Canva, product Affinity, and the vulnerability exists in all releases prior to the October 2026 3.3.1 update.

With a CVSS score of 3.6 the severity is moderate, reflecting primarily a denial of service. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, indicating that widespread exploitation is not yet documented. The likely attack vector is a crafted Affinity document delivered via email, shared file, or other user‑initiated opening, leading to a crash when the document is processed.