CVE-2025-61952: Canva Affinity Information Disclosure

CVE-2025-61952 Overview

An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information. This vulnerability requires local access and user interaction, typically through convincing a user to open a malicious EMF file within the Canva Affinity application.

Critical Impact

Successful exploitation could allow attackers to read sensitive memory contents beyond intended buffer boundaries, potentially exposing confidential data or application secrets. Additionally, the vulnerability can cause application crashes leading to denial of service.

Affected Products

• Canva Affinity for Windows (all versions prior to patch)
• Applications processing EMF files through Canva Affinity's rendering engine
• Canva Affinity design workflows utilizing EMF import functionality

Discovery Timeline

• 2026-03-17 - CVE-2025-61952 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2025-61952

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), which occurs when the software reads data past the end or before the beginning of an intended buffer. In the context of Canva Affinity's EMF parsing functionality, the application fails to properly validate bounds when processing certain structures within EMF files.

The attack requires local access and user interaction—an attacker must convince a victim to open a maliciously crafted EMF file. Once opened, the crafted file triggers the out-of-bounds read condition, allowing the attacker to potentially access memory regions containing sensitive information that should not be accessible during normal EMF processing operations.

The vulnerability can result in both information disclosure (reading sensitive memory contents) and denial of service through application crashes when the invalid memory access triggers a fault.

Root Cause

The root cause lies in insufficient bounds checking within Canva Affinity's EMF file parsing routines. When processing EMF records or structures, the application does not adequately validate that read operations remain within allocated buffer boundaries. Malformed EMF headers or record structures can specify sizes or offsets that cause the parser to read beyond legitimate buffer limits.

This type of vulnerability commonly occurs when:

• Record length fields are not validated against actual buffer sizes
• Pointer arithmetic during EMF structure traversal lacks boundary checks
• Nested structures within EMF files reference invalid memory regions

Attack Vector

The attack vector is local and requires user interaction. An attacker would need to:

1. Craft a malicious EMF file containing specially constructed records or structures designed to trigger the out-of-bounds read
2. Deliver the malicious EMF file to a victim through email attachments, file sharing, or other distribution methods
3. Convince the victim to open the file using Canva Affinity

The malicious EMF file would contain manipulated header fields, record sizes, or offset values that cause the EMF parser to read beyond allocated memory buffers. This could expose adjacent memory contents, including potentially sensitive application data, heap metadata, or other confidential information stored in nearby memory regions.

For detailed technical information, refer to the Talos Intelligence Vulnerability Report.

Detection Methods for CVE-2025-61952

Indicators of Compromise

• Unusual application crashes or exceptions in Canva Affinity when processing EMF files
• Memory access violation errors reported in application logs
• Unexpected EMF files appearing in user directories from untrusted sources
• Canva Affinity processes exhibiting abnormal memory read patterns

Detection Strategies

• Monitor for Canva Affinity process crashes associated with EMF file operations
• Implement file integrity monitoring for incoming EMF files in high-risk environments
• Deploy endpoint detection rules to identify suspicious EMF file characteristics such as malformed headers or unusual record sizes
• Enable application crash reporting and analyze memory dump files for out-of-bounds read signatures

Monitoring Recommendations

• Configure SentinelOne agents to monitor Canva Affinity application behavior for anomalous memory access patterns
• Implement email and file gateway scanning to detect potentially malicious EMF files before they reach end users
• Enable detailed logging for file operations involving EMF format to facilitate forensic analysis
• Monitor for repeated application restarts or user complaints about Canva Affinity stability

How to Mitigate CVE-2025-61952

Immediate Actions Required

• Review and apply security updates from Canva as soon as they become available
• Restrict EMF file processing to trusted sources only until patching is complete
• Educate users about the risks of opening EMF files from unknown or untrusted sources
• Consider temporarily disabling EMF import functionality if business operations permit

Patch Information

Canva has published security information regarding this vulnerability. Organizations should consult the Canva Trust Security Overview for official patch availability and update instructions. Apply the latest Canva Affinity updates as soon as they are released to remediate this vulnerability.

Workarounds

• Block or quarantine EMF files at email gateways and network perimeters until patches are deployed
• Implement application whitelisting policies to prevent unauthorized EMF file sources from being processed
• Use alternative file formats (such as PNG, JPEG, or SVG) for design workflows where EMF is not strictly required
• Isolate Canva Affinity installations in sandboxed environments when processing files from untrusted sources

# Example: Block EMF file extensions at the gateway level
# Add to email gateway or web proxy block rules:
# File extension: .emf
# MIME type: image/x-emf, application/x-emf

# Windows Group Policy - Disable EMF file associations (temporary workaround)
# Navigate to: User Configuration > Administrative Templates > Windows Components
# Configure file association policies to prevent automatic opening of EMF files