CVE-2026-81546: Affinity by Canva RCE Vulnerability

CVE-2026-81546 Overview

CVE-2026-81546 is a stack-based buffer overflow [CWE-121] in the Affinity by Canva desktop application. Versions prior to 3.3.0 (the September 2026 release) fail to perform adequate bounds checking when parsing Affinity document files. A threat actor can craft a malicious Affinity document that, when opened by a user, triggers memory corruption and can result in arbitrary code execution in the context of the current user.

Critical Impact
Opening a crafted Affinity document can lead to arbitrary code execution on the victim workstation, compromising confidentiality, integrity, and availability of local user data.

Affected Products

Affinity by Canva desktop application prior to version 3.3.0
Affinity document (.afdesign, .afphoto, .afpub) file parsing components
Workstations running vulnerable Affinity installations across supported platforms

Discovery Timeline

2026-09-17 - CVE-2026-81546 published to the National Vulnerability Database
2026-09-17 - Last updated in the NVD database

Technical Details for CVE-2026-81546

Vulnerability Analysis

The flaw resides in the document parser used by Affinity to load its native file formats. The parser reads structured data from an untrusted file into fixed-size stack buffers without validating field lengths against buffer capacity. An attacker who controls the document contents controls the amount and content of data written to the stack, overwriting adjacent stack frames including saved return addresses and structured exception handlers.

Successful exploitation yields arbitrary code execution under the identity of the user who opened the file. Because the attack requires local file interaction and user action, delivery typically occurs through phishing, shared design assets, or supply-chain distribution of trojanized templates.

Root Cause

The root cause is missing bounds checking on length-prefixed or delimiter-terminated fields inside the Affinity document container. When the parser copies these fields into stack-allocated buffers, oversized values from the file corrupt the stack frame. The condition is classified as CWE-121: Stack-based Buffer Overflow.

Attack Vector

Exploitation requires a user to open a malicious Affinity document in a vulnerable version of the application. The attack complexity is high because reliable exploitation must contend with modern stack protections such as stack canaries, Address Space Layout Randomization (ASLR), and Data Execution Prevention (DEP). A successful exploit crosses a trust boundary from the document into the host process, allowing execution outside the original security scope.

No verified proof-of-concept code is publicly available. The vulnerability is described in prose only; see the Canva Trust Platform Overview for vendor communications.

Detection Methods for CVE-2026-81546

Indicators of Compromise

Affinity application processes spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters shortly after a document open event.
Crash reports or Windows Error Reporting entries referencing Affinity binaries with access violations in parsing routines.
Untrusted .afdesign, .afphoto, or .afpub files delivered by email, chat, or shared drives from external sources.

Detection Strategies

Monitor endpoint telemetry for anomalous process lineage where the Affinity executable is the parent of scripting or LOLBin processes.
Alert on Affinity process crashes followed by network egress or persistence activity on the same host.
Correlate file-open events for Affinity document extensions with new outbound connections to unfamiliar destinations.

Monitoring Recommendations

Ingest endpoint process, file, and network events into a centralized data lake for retrospective hunting across Affinity workstations.
Track installed Affinity versions across the fleet and flag any host running a build earlier than 3.3.0.
Review email and collaboration gateways for inbound Affinity document attachments from external senders.

How to Mitigate CVE-2026-81546

Immediate Actions Required

Upgrade all Affinity by Canva installations to version 3.3.0 (September 2026 release) or later.
Instruct users not to open Affinity documents received from untrusted or unverified sources.
Inventory endpoints to identify vulnerable Affinity installations and prioritize patching for design and marketing teams.

Patch Information

Canva addressed the stack-based buffer overflow in Affinity 3.3.0, released in September 2026. Refer to the Canva Trust Platform Overview for vendor advisories and update guidance.

Workarounds

Restrict opening of Affinity documents to files originating from trusted internal repositories until patching is complete.
Apply application allowlisting to prevent Affinity processes from launching command interpreters or scripting engines.
Enable operating-system exploit mitigations such as DEP, ASLR, and Control Flow Guard for the Affinity executables where supported.

bash

# Example: query installed Affinity version on Windows endpoints
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like 'Affinity*' } |
  Select-Object DisplayName, DisplayVersion, Publisher