CVE-2025-66000: Canva Affinity Information Disclosure Flaw

CVE-2025-66000 Overview

An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) functionality of Canva Affinity. This vulnerability allows an attacker to craft a malicious EMF file that, when processed by the application, causes the software to read memory beyond the intended boundaries. Successful exploitation could lead to the disclosure of sensitive information stored in adjacent memory regions.

Critical Impact

Attackers can leverage specially crafted EMF files to extract sensitive information from memory, potentially exposing confidential data, internal application state, or memory contents that could aid in further attacks.

Affected Products

• Canva Affinity for Windows (all versions prior to patch)

Discovery Timeline

• 2026-03-17 - CVE-2025-66000 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2025-66000

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory safety issue that occurs when the application reads data past the end or before the beginning of the intended buffer. In the context of Canva Affinity, this flaw exists within the EMF file processing functionality, where malformed EMF records can trigger memory reads outside allocated buffer boundaries.

The attack requires local access and user interaction—specifically, a user must open a maliciously crafted EMF file. When the vulnerable parsing routine processes the malformed EMF data, it fails to properly validate the size or offset parameters, resulting in the application reading memory beyond the designated buffer. This can expose sensitive data including heap contents, stack data, or other process memory that may contain credentials, session tokens, or other confidential information.

Root Cause

The root cause of this vulnerability lies in insufficient bounds checking within the EMF parsing logic. When processing EMF file records, the application fails to validate that read operations remain within the allocated buffer boundaries. This allows a specially crafted EMF file to specify malicious size or offset values that cause the parser to read beyond the intended memory region.

Attack Vector

Exploitation requires local access with user interaction. An attacker would need to craft a malicious EMF file containing manipulated record structures designed to trigger the out-of-bounds read condition. The attack scenario typically involves:

1. Creating a specially crafted EMF file with malformed record headers or data structures
2. Delivering the malicious file to the target user via email, file sharing, or other distribution methods
3. Convincing the user to open the file with Canva Affinity
4. The vulnerable parsing routine processes the malformed data and reads beyond buffer boundaries
5. Sensitive memory contents are potentially exposed to the attacker

The vulnerability mechanism involves malformed EMF record processing that bypasses boundary validation. When Canva Affinity parses EMF files, it reads record structures and their associated data. A crafted EMF file can specify invalid sizes or offsets that cause the parser to access memory outside the intended buffer, potentially leaking sensitive information. For detailed technical analysis, refer to the Talos Intelligence Vulnerability Report.

Detection Methods for CVE-2025-66000

Indicators of Compromise

• Presence of suspicious or unexpected EMF files in user directories or email attachments
• Abnormal memory access patterns in Canva Affinity processes
• Application crashes or unexpected behavior when processing EMF files
• Unusual EMF file characteristics such as malformed record headers or suspicious size values

Detection Strategies

• Monitor file system activity for EMF files from untrusted sources being opened by Canva Affinity
• Implement endpoint detection rules to identify abnormal memory read patterns in design application processes
• Deploy file-type analysis to inspect EMF files for malformed or suspicious record structures
• Enable application crash monitoring to detect potential exploitation attempts

Monitoring Recommendations

• Configure SentinelOne to monitor Canva Affinity process behavior for anomalous memory access patterns
• Enable detailed logging for file access events involving EMF files
• Implement user awareness training regarding suspicious file attachments and downloads
• Review application logs for repeated crashes or errors related to EMF file processing

How to Mitigate CVE-2025-66000

Immediate Actions Required

• Apply the vendor-provided security patch as soon as it becomes available
• Restrict opening of EMF files from untrusted or unknown sources
• Implement file quarantine policies for EMF attachments in email gateways
• Consider temporarily disabling EMF file handling in Canva Affinity until patched

Patch Information

Canva has acknowledged this vulnerability and released security guidance. Users should consult the Canva Trust Resource for official patch information and update instructions. Ensure Canva Affinity is updated to the latest available version that addresses this vulnerability.

Workarounds

• Block or quarantine EMF files at the email gateway and perimeter security controls
• Disable automatic preview or rendering of EMF files in file browsers
• Use alternative applications for EMF file processing until Canva Affinity is patched
• Implement strict file handling policies requiring verification of EMF file sources before opening

# Example: Block EMF files at the email gateway (configuration varies by product)
# Add EMF extension to blocked file types in your email security solution
# Review and validate EMF files in a sandboxed environment before allowing access