The vulnerability is an out‑of‑bounds heap read that occurs when Affinity for macOS generates QuickLook thumbnails or previews of document files. A crafted Affinity document can cause the preview extension to read beyond the intended buffer, potentially exposing the contents of adjacent heap memory in the rendered image or, alternatively, causing the preview to crash. The weakness is classified as CWE‑126, leading to possible partial information disclosure or denial of service.

Canva’s Affinity application for macOS versions prior to 3.3.1 (October 2026 release) is affected. Users running any earlier version of Affinity on macOS are susceptible when the Finder QuickLook feature generates thumbnails or previews of Affinity documents.

The reported CVSS score of 2.9 indicates a low‑severity vulnerability. The EPSS is not available, and the flaw is not listed in CISA KEV, suggesting that widespread exploitation is not documented. Likely exploitation would require a local user to open a malicious Affinity file that triggers a QuickLook preview, leading to disclosure of nearby heap memory or a crash of the preview extension. While the impact is limited to information leakage or instability, the presence of the flaw means any user who allows previewing of unknown Affinity documents could be affected.