CVE-2025-64776: Canva Affinity Information Disclosure Flaw

CVE-2025-64776 Overview

An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information. This memory corruption vulnerability (CWE-125) requires user interaction to exploit, as the victim must open a malicious EMF file.

Critical Impact
Successful exploitation could allow attackers to read sensitive memory contents, potentially exposing confidential data or enabling further attacks through information disclosure. The vulnerability also poses a denial of service risk through application crashes.

Affected Products

Canva Affinity for Windows (all vulnerable versions)
Applications using Canva Affinity EMF parsing functionality

Discovery Timeline

2026-03-17 - CVE-2025-64776 published to NVD
2026-03-19 - Last updated in NVD database

Technical Details for CVE-2025-64776

Vulnerability Analysis

This vulnerability is classified as an out-of-bounds read (CWE-125), a memory safety issue that occurs when the application reads data beyond the intended buffer boundaries. In the context of Canva Affinity's EMF processing, the vulnerability arises during the parsing of Enhanced Metafile format files.

EMF files are a Windows graphics format used for storing vector images. When Canva Affinity processes a malformed EMF file, insufficient bounds checking allows the application to read memory locations outside the allocated buffer. This can result in exposure of sensitive information stored in adjacent memory regions or cause application instability leading to denial of service.

The local attack vector requires an attacker to convince a user to open a malicious EMF file, typically through social engineering tactics such as phishing emails or malicious downloads. No privileges are required on the target system, but user interaction is mandatory for exploitation.

Root Cause

The root cause of this vulnerability lies in improper bounds validation within Canva Affinity's EMF parsing routines. When processing EMF file structures, the application fails to properly validate that read operations remain within the bounds of allocated memory buffers. Specifically, malformed EMF record headers or data lengths can cause the parser to read beyond buffer boundaries, leading to information disclosure.

Attack Vector

The attack requires local access and user interaction. An attacker must craft a malicious EMF file containing specially constructed metadata or record structures designed to trigger the out-of-bounds read condition. The attack scenario typically involves:

Attacker creates a malformed EMF file with crafted record lengths or offsets
The file is delivered to the victim through email attachments, file sharing, or compromised websites
When the victim opens the file in Canva Affinity, the EMF parser reads beyond buffer boundaries
Sensitive memory contents are exposed to the attacker or the application crashes

For detailed technical analysis, refer to the Talos Intelligence Vulnerability Report.

Detection Methods for CVE-2025-64776

Indicators of Compromise

Unusual EMF files with abnormal record sizes or malformed headers appearing in user directories
Canva Affinity application crashes or unexpected termination when processing EMF files
Memory access violations or segmentation faults in application logs
Suspicious EMF file attachments in recent email communications

Detection Strategies

Monitor for Canva Affinity process crashes or exceptions related to EMF file processing
Implement file inspection for incoming EMF files to detect malformed structures
Deploy endpoint detection and response (EDR) solutions to identify exploitation attempts
Configure application allowlisting to restrict execution of potentially malicious files

Monitoring Recommendations

Enable detailed logging for Canva Affinity application events and errors
Monitor system event logs for memory access violations associated with Affinity processes
Track file access patterns for EMF files, particularly from untrusted sources
Implement network monitoring to detect suspicious file downloads with EMF extensions

How to Mitigate CVE-2025-64776

Immediate Actions Required

Update Canva Affinity to the latest patched version as soon as updates are available
Exercise caution when opening EMF files from untrusted or unknown sources
Consider temporarily disabling EMF file processing if not critical to operations
Educate users about the risks of opening files from untrusted sources

Patch Information

Canva has released a security advisory addressing this vulnerability. Users should consult the Canva Trust Advisory for official patch information and update instructions. It is strongly recommended to apply vendor-provided patches immediately upon availability.

Workarounds

Avoid opening EMF files from untrusted or unknown sources until patches are applied
Implement file type restrictions to block EMF files at email gateways and web proxies
Use application sandboxing to isolate Canva Affinity from sensitive system resources
Consider using alternative applications for EMF file processing until the vulnerability is addressed