Out-of-Bounds Write Vulnerability in Canva Affinity by Canva
CVE-2025-64301

7.8HIGH

Key Information:

Vendor

Canva

Status
Affinity
Vendor
CVE Published:
17 March 2026

What is CVE-2025-64301?

An out-of-bounds write vulnerability exists within the Enhanced Metafile (EMF) handling functionality of Canva Affinity. By crafting a specially designed EMF file, an attacker can exploit this vulnerability to perform an out-of-bounds write operation, potentially leading to arbitrary code execution within the affected application. This highlights critical security concerns for users relying on Canva Affinity for their design needs.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Affinity 3.0.1.3808

References

https://talosintelligence.com/vulnerability_reports/TALOS...
https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered by KPC of Cisco Talos.
JSON
.