Type Confusion Vulnerability in Canva Affinity Software
CVE-2025-66342

7.8HIGH

Key Information:

Vendor

Canva

Status
Affinity
Vendor
CVE Published:
17 March 2026

What is CVE-2025-66342?

A type confusion vulnerability has been identified in the EMF functionality of Canva Affinity. This vulnerability can be exploited through specially crafted EMF files, potentially leading to memory corruption and allowing an attacker to execute arbitrary code on the affected system. Proper handling and validation of EMF files is crucial to mitigate the risks associated with this vulnerability.

Affected Version(s)

Affinity 3.0.1.3808

References

https://talosintelligence.com/vulnerability_reports/TALOS...
https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered by KPC of Cisco Talos.
.