The Affinity by Canva application for macOS performs thumbnail and preview generation for Affinity document files using QuickLook. In versions preceding 3.3.1, the driver performed insufficient bounds checking, allowing an out‑of‑bounds heap read during the creation of thumbnails. An attacker who can supply a crafted Affinity document can trigger the vulnerability when the file is viewed or previewed in Finder, potentially leaking the contents of adjacent heap memory, including memory addresses that may aid further exploitation.

Systems running Affinity by Canva on macOS, specifically versions earlier than 3.3.1, are affected. The vulnerability does not affect other operating systems or versions of the application released after or including the 3.31 update.

The risk for a local user is primarily the disclosure of sensitive memory contents. The CVSS score of 3.6 indicates a low severity, and the EPSS score is not available, making it difficult to gauge current exploitation probability. The vulnerability requires an attacker to supply a malicious file and the victim to open or preview it in Finder, creating a limited attack surface. It is not currently listed in the CISA KEV catalog.