CVE-2025-66342

HIGH

Canva Affinity <3.1.0 - Memory Corruption

Title source: llm
STIX 2.1

Description

A type confusion vulnerability exists in the EMF functionality of Canva Affinity. A specially crafted EMF file can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution.

References (3)

Scores

CVSS v3 7.8
EPSS 0.0001
EPSS Percentile 1.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-843
Status published
Products (3)
canva/affinity < 3.1.0
Canva/Affinity < 3.1.0 (March 26)
Canva/Affinity 3.0.1.3808
Published Mar 17, 2026
Tracked Since Mar 18, 2026