The vulnerability in Affinity for macOS is an integer overflow that occurs when the application calculates the size of an image buffer for QuickLook thumbnails and previews of Affinity documents. The overflow allows the size to be computed incorrectly, leading to a heap‑based buffer overflow that can corrupt memory. A crash of the thumbnail or preview extension follows, which can disrupt a user’s workflow but does not provide code execution or other higher‑level access.

The affected product is Affinity by Canva for macOS. Versions earlier than 3.3.1, released in October 2026, are vulnerable. Any machine that installed those versions with the ability to generate QuickLook previews of Affinity files is at risk.

The CVSS score of 4.9 indicates moderate overall severity. EPSS shows no data, and the vulnerability is not listed in CISA KEV. The most likely attack vector requires a user to view or preview a specially crafted Affinity document in Finder’s QuickLook feature, which is typically a local user or a user who opens a file. Because the impact is limited to an application crash, the risk to confidentiality or integrity is minimal, but repeated crashes could affect availability or user trust.