CVE-2025-66633: Canva Affinity Information Disclosure

CVE-2025-66633 Overview

An out-of-bounds read vulnerability exists in the Enhanced Metafile (EMF) processing functionality of Canva Affinity. This memory safety flaw occurs when the application parses specially crafted EMF files, allowing an attacker to read memory beyond the intended buffer boundaries. Successful exploitation could lead to the disclosure of sensitive information stored in adjacent memory regions or cause application crashes resulting in denial of service conditions.

Critical Impact
Attackers can exploit this vulnerability to leak sensitive memory contents or crash the application by delivering malicious EMF files to users of Canva Affinity on Windows systems.

Affected Products

Canva Affinity for Windows (all versions prior to patch)

Discovery Timeline

2026-03-17 - CVE-2025-66633 published to NVD
2026-03-19 - Last updated in NVD database

Technical Details for CVE-2025-66633

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-Bounds Read), a memory safety issue that occurs when software reads data past the end or before the beginning of an intended buffer. In the context of Canva Affinity's EMF processing functionality, the application fails to properly validate boundaries when parsing Enhanced Metafile format records, allowing specially crafted EMF files to trigger reads from unintended memory locations.

The exploitation requires local access and user interaction—specifically, a victim must open a malicious EMF file. While this attack cannot be executed remotely without user involvement, the potential for information disclosure is significant. Leaked memory could contain sensitive data such as encryption keys, authentication tokens, or other confidential information stored in adjacent memory regions. Additionally, the out-of-bounds read can cause application instability or crashes, impacting availability.

Root Cause

The root cause of this vulnerability lies in insufficient bounds checking within Canva Affinity's EMF parsing routines. When processing EMF file structures, the application does not adequately validate that read operations remain within allocated buffer boundaries. This allows malformed EMF records with manipulated size or offset fields to cause the parser to read beyond the legitimate data boundaries.

Attack Vector

The attack requires local access to the target system. An attacker must craft a malicious EMF file containing specially constructed records that exploit the boundary validation weakness. The attacker then needs to deliver this file to a victim through social engineering techniques such as email attachments, malicious downloads, or compromised file-sharing platforms. When the victim opens the malicious EMF file in Canva Affinity, the out-of-bounds read is triggered.

The vulnerability mechanism involves manipulated EMF record structures that specify data sizes or offsets exceeding actual buffer allocations. When the parser processes these records without proper validation, it reads beyond buffer boundaries, exposing adjacent memory contents or causing the application to crash when accessing invalid memory addresses.

Detection Methods for CVE-2025-66633

Indicators of Compromise

Unexpected crashes in Canva Affinity when opening EMF files
Abnormal memory access patterns or access violation errors in application logs
Presence of suspicious or unexpected EMF files from untrusted sources
Application generating unusually large error dumps or crash reports

Detection Strategies

Monitor for abnormal process termination events in Canva Affinity with memory-related exit codes
Implement file integrity monitoring to detect suspicious EMF files entering the environment
Deploy endpoint detection rules to identify EMF files with anomalous record structures
Enable application crash reporting and analyze dumps for out-of-bounds read patterns

Monitoring Recommendations

Configure SentinelOne agents to monitor Canva Affinity process behavior for memory access anomalies
Establish baseline metrics for EMF file processing and alert on deviations
Monitor email attachments and downloads for EMF files from untrusted sources
Review Windows Event Logs for application crash events related to Affinity products

How to Mitigate CVE-2025-66633

Immediate Actions Required

Apply the latest security updates from Canva as soon as they become available
Restrict EMF file access from untrusted sources until patching is complete
Educate users about the risks of opening EMF files from unknown or untrusted senders
Consider temporarily disabling EMF file handling if business operations permit

Patch Information

Canva has released a security update addressing this vulnerability. Organizations should consult the Canva Trust Security Update for detailed patching instructions and affected version information. Additionally, technical details are available in the Talos Intelligence Vulnerability Report.

Workarounds

Block or quarantine EMF file attachments at email and web gateways
Implement application whitelisting to prevent execution of untrusted EMF files
Configure file system permissions to restrict EMF file access to essential users only
Deploy network segmentation to limit the impact of potential exploitation

bash

# Configuration example - Block EMF file extensions at the gateway level
# Example Windows Defender Application Control rule to block EMF files from untrusted sources
# Add to your WDAC policy XML configuration

# For email gateway filtering (example rule syntax):
# action=quarantine, attachment_extension=.emf, sender_trust=untrusted