CVE-2025-66042: Canva Affinity Information Disclosure

CVE-2025-66042 Overview

An out-of-bounds read vulnerability exists in the EMF (Enhanced Metafile) functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information. This vulnerability requires user interaction, as the victim must open a malicious EMF file for the attack to succeed.

Critical Impact

Exploitation of this vulnerability could allow attackers to read sensitive memory contents beyond intended buffer boundaries, potentially exposing confidential data or enabling further attack chains. The vulnerability also poses a denial of service risk through application crashes.

Affected Products

• Canva Affinity for Windows (all versions prior to patched release)

Discovery Timeline

• 2026-03-17 - CVE-2025-66042 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2025-66042

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-bounds Read), a memory corruption flaw that occurs when the application reads data past the end or before the beginning of an intended buffer. In the context of Canva Affinity, the EMF parsing functionality fails to properly validate bounds when processing Enhanced Metafile records.

When Canva Affinity processes a maliciously crafted EMF file, insufficient boundary checking allows the application to read memory locations outside the allocated buffer. This can result in two primary impacts: disclosure of sensitive information that may reside in adjacent memory regions, and denial of service if the read operation accesses invalid memory causing an application crash.

The attack requires local access and user interaction—specifically, a victim must be convinced to open a malicious EMF file using Canva Affinity. This attack vector is commonly exploited through social engineering tactics such as phishing emails with malicious attachments or drive-by downloads from compromised websites.

Root Cause

The root cause of this vulnerability lies in improper bounds validation within the EMF file parsing routines of Canva Affinity. When processing EMF records, the application fails to adequately verify that data lengths and offsets specified within the file remain within the bounds of allocated memory buffers. This allows a crafted EMF file to specify malicious parameters that cause the application to read beyond buffer boundaries.

Attack Vector

The attack vector for CVE-2025-66042 is local, requiring an attacker to deliver a malicious EMF file to the target system. The exploitation scenario typically unfolds as follows:

1. The attacker crafts a malicious EMF file containing specially structured records with invalid length or offset values
2. The malicious file is delivered to the victim through email attachment, file sharing, or other distribution methods
3. The victim opens the malicious EMF file using Canva Affinity
4. During file parsing, the application reads memory beyond intended buffer boundaries
5. Sensitive data from adjacent memory may be exposed, or the application may crash

The vulnerability manifests during EMF record processing when boundary validation is insufficient. For detailed technical analysis, refer to the Talos Intelligence Vulnerability Report.

Detection Methods for CVE-2025-66042

Indicators of Compromise

• Unexpected crashes or abnormal termination of Canva Affinity processes when opening EMF files
• EMF files with unusually large or malformed record structures in user directories or email attachments
• Memory access violations logged by the operating system related to Affinity processes
• Suspicious EMF file attachments from unknown or untrusted sources

Detection Strategies

• Implement file integrity monitoring for EMF files arriving via email or web downloads
• Deploy endpoint detection rules to monitor for abnormal memory access patterns in Canva Affinity processes
• Configure application whitelisting to restrict EMF file execution from untrusted locations
• Enable crash dump analysis to identify exploitation attempts through memory violation patterns

Monitoring Recommendations

• Monitor endpoint telemetry for Canva Affinity process crashes with memory access violation signatures
• Establish baseline behavior for EMF file processing and alert on anomalies
• Review email gateway logs for EMF file attachments from external sources
• Implement SentinelOne's behavioral AI to detect out-of-bounds memory access attempts in real-time

How to Mitigate CVE-2025-66042

Immediate Actions Required

• Update Canva Affinity to the latest patched version as soon as available from the vendor
• Exercise caution when opening EMF files from untrusted or unknown sources
• Implement email filtering to quarantine or block EMF attachments from external sources
• Enable application sandboxing where available to limit the impact of potential exploitation

Patch Information

Canva has released security guidance for this vulnerability. Users should consult the Canva Trust Security Resource for official patch information and updated software versions. It is strongly recommended to apply vendor patches immediately upon availability.

Workarounds

• Disable automatic preview of EMF files in file browsers and email clients
• Implement network-level filtering to block or quarantine EMF files from external sources
• Use application control policies to restrict which applications can process EMF files
• Consider temporarily blocking EMF file types at the email gateway until patches are applied

# Windows Group Policy: Block EMF file associations (temporary workaround)
# Run in elevated PowerShell to remove EMF file associations
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Classes\.emf" -Name "(Default)" -ErrorAction SilentlyContinue
# Monitor for EMF files in common download locations
Get-ChildItem -Path "$env:USERPROFILE\Downloads" -Filter "*.emf" -Recurse