CVE-2025-65119: Canva Affinity Information Disclosure Flaw

CVE-2025-65119 Overview

An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) functionality of Canva Affinity. This memory corruption vulnerability allows attackers to craft malicious EMF files that, when processed by the application, trigger an out-of-bounds read condition. Successful exploitation could lead to the disclosure of sensitive information from process memory and potentially cause application crashes resulting in denial of service.

Critical Impact

Attackers can exploit this vulnerability to exfiltrate sensitive information from memory and cause application instability through specially crafted EMF files.

Affected Products

• Canva Affinity for Windows (all versions prior to patch)

Discovery Timeline

• 2026-03-17 - CVE-2025-65119 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2025-65119

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory safety issue where the application reads data from a location outside the intended buffer boundaries. The vulnerability exists within the EMF file parsing functionality of Canva Affinity on Windows systems.

The attack requires local access and user interaction, meaning an attacker must convince a victim to open a maliciously crafted EMF file. Once opened, the vulnerable parsing code reads beyond allocated buffer boundaries, potentially exposing sensitive data stored in adjacent memory regions. This could include application secrets, cryptographic material, or other confidential information present in the process memory space.

The vulnerability poses both confidentiality and availability risks. Memory contents can be leaked through the out-of-bounds read operation, and improper memory access can trigger application crashes, resulting in denial of service conditions.

Root Cause

The root cause stems from insufficient bounds checking in the EMF file parsing routines. When processing EMF records, the application fails to properly validate that data lengths and offsets remain within allocated buffer boundaries. This allows specially constructed EMF files to specify parameters that cause the parser to read beyond the legitimate data boundaries.

EMF files contain various records with length and offset fields. When these fields are manipulated to contain values exceeding actual buffer sizes, the vulnerable code continues reading past the allocated memory region, exposing whatever data happens to reside in adjacent memory locations.

Attack Vector

The attack vector is local with user interaction required. An attacker would need to:

1. Craft a malicious EMF file containing manipulated record structures designed to trigger the out-of-bounds read condition
2. Deliver the malicious file to the victim through social engineering, email attachments, or file-sharing platforms
3. Convince the victim to open the file using Canva Affinity

The vulnerability manifests when the EMF parsing functionality processes malformed record structures that specify data lengths exceeding actual buffer allocations. The parser reads beyond buffer boundaries, potentially disclosing process memory contents. Technical details and proof-of-concept information can be found in the Talos Intelligence Vulnerability Report.

Detection Methods for CVE-2025-65119

Indicators of Compromise

• Unusual EMF files received via email or downloaded from untrusted sources
• Canva Affinity application crashes when opening EMF files
• Memory access violations or segmentation faults in application logs
• Unexpected data exfiltration attempts following EMF file processing

Detection Strategies

• Monitor for Canva Affinity process crashes or access violations when handling EMF files
• Implement file scanning to detect malformed EMF files with suspicious record structures
• Deploy endpoint detection solutions capable of identifying out-of-bounds memory access patterns
• Alert on unusual memory read patterns from Canva Affinity processes

Monitoring Recommendations

• Enable detailed application crash logging for Canva Affinity installations
• Monitor file system activity for EMF files from untrusted sources
• Configure endpoint protection to alert on memory access anomalies in creative software
• Review user-reported application stability issues involving EMF file handling

How to Mitigate CVE-2025-65119

Immediate Actions Required

• Apply security patches from Canva as they become available
• Restrict processing of EMF files from untrusted sources
• Educate users about the risks of opening EMF files from unknown senders
• Consider blocking or quarantining EMF files at email and web gateways until patched

Patch Information

Canva has acknowledged this vulnerability through their trust portal. Affected users should consult the Canva Trust Resource for official patch information and security updates. Monitor vendor communications for remediation guidance and apply updates promptly when released.

Workarounds

• Avoid opening EMF files from untrusted or unknown sources until the patch is applied
• Use alternative file formats where possible to reduce exposure to the vulnerable EMF parsing functionality
• Implement application sandboxing to limit the impact of potential exploitation
• Deploy SentinelOne endpoint protection to detect and prevent exploitation attempts

# Configuration example - Block EMF files at gateway level
# Add to email gateway filter rules
BLOCK_EXTENSIONS=".emf"
QUARANTINE_ACTION="isolate"
NOTIFY_ADMIN=true