Heap-Based Buffer Overflow in Affinity by Canva for macOS

CVE-2026-96396

What is CVE-2026-96396?

The Affinity by Canva application for macOS, prior to version 3.3.1, fails to properly manage the size of image buffers when creating QuickLook thumbnails and previews. This failure can trigger an integer overflow, potentially leading to a heap-based buffer overflow. An attacker could craft a malicious Affinity document that, when viewed or previewed in Finder, could compromise the heap memory, resulting in the crashing of the thumbnail or preview extension. This flaw highlights the importance of secure memory management in software applications.

References