Heap Buffer Over-read in Affinity by Canva Affects Document Files

CVE-2026-101130

What is CVE-2026-101130?

The Affinity by Canva application versions prior to 3.3.1 lack proper bounds checking when processing arrays of strings in Affinity document files. This oversight allows a malicious actor to create a specially crafted Affinity document. Upon opening, this can lead to the exposure of sensitive information from adjacent heap memory or potentially cause the application to crash, posing significant security risks for users.

References