Out-of-Bounds Read Vulnerability in Canva Affinity by Canva
CVE-2025-61952

6.1MEDIUM

Key Information:

Vendor

Canva

Status
Affinity
Vendor
CVE Published:
17 March 2026

What is CVE-2025-61952?

Canva Affinity has a vulnerability in its EMF functionality that allows attackers to exploit specially crafted EMF files. By leveraging this out-of-bounds read vulnerability, an attacker may access sensitive information, posing significant risks to users' data privacy and security. Organizations using Canva Affinity should urgently assess their exposure and implement necessary mitigations.

Affected Version(s)

Affinity 3.0.1.3808

References

https://talosintelligence.com/vulnerability_reports/TALOS...
https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered by KPC of Cisco Talos.
.