CVE Intelligence

Canva vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Canva products: 27 record(s), with severity, exploitation and fixes.

Affinity 26Canva 1

Exploited only (KEV) →

CVE-2026-96396 Medium · 4.9 CWE-122 Oct 9, 2026
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely...
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could corrupt heap memory and cause the thumbnail or preview extension to crash.
CVE-2026-96395 Low · 3.6 CWE-125 Oct 9, 2026
The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate...
The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory, including memory addresses, in the rendered thumbnail or preview image.
CVE-2026-96394 Low · 2.9 CWE-126 Oct 9, 2026
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate...
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory in the rendered thumbnail or preview image, or cause the thumbnail or preview extension to crash.
CVE-2026-96393 Low · 3.6 CWE-822 Oct 9, 2026
The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds...
The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in an application crash.
CVE-2026-103220 Medium · 4.5 CWE-129 Oct 9, 2026
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate...
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and the dereference of an untrusted pointer. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in memory corruption or an application crash.
CVE-2026-101130 Low · 3.6 CWE-126 Oct 9, 2026
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate...
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.
CVE-2026-101094 Low · 3.6 CWE-126 Oct 9, 2026
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle...
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.
CVE-2026-22882 High · 7.1 CWE-125 Mar 17, 2026
Out-of-bounds Read in Canva Affinity
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
CVE-2026-20726 High · 7.1 CWE-125 Mar 17, 2026
Out-of-bounds Read in Canva Affinity
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
CVE-2025-66633 High · 7.1 CWE-125 Mar 17, 2026
Out-of-bounds Read in Canva Affinity
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
CVE-2025-66617 High · 7.1 CWE-125 Mar 17, 2026
Out-of-bounds Read in Canva Affinity
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
CVE-2025-66503 High · 7.1 CWE-125 Mar 17, 2026
Out-of-bounds Read in Canva Affinity
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
CVE-2025-66342 High · 7.8 CWE-843 Mar 17, 2026
Type Confusion in Canva Affinity
A type confusion vulnerability exists in the EMF functionality of Canva Affinity. A specially crafted EMF file can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution.
CVE-2025-66042 High · 7.1 CWE-125 Mar 17, 2026
Out-of-bounds Read in Canva Affinity
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
CVE-2025-66000 High · 7.1 CWE-125 Mar 17, 2026
Out-of-bounds Read in Canva Affinity
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
CVE-2025-65119 High · 7.1 CWE-125 Mar 17, 2026
Out-of-bounds Read in Canva Affinity
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
CVE-2025-64776 High · 7.1 CWE-125 Mar 17, 2026
Out-of-bounds Read in Canva Affinity
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
CVE-2025-64735 High · 7.1 CWE-125 Mar 17, 2026
Out-of-bounds Read in Canva Affinity
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
CVE-2025-64733 High · 7.1 CWE-125 Mar 17, 2026
Out-of-bounds Read in Canva Affinity
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
CVE-2025-64301 High · 7.8 CWE-787 Mar 17, 2026
Out-of-bounds Write in Canva Affinity
An out‑of‑bounds write vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out‑of‑bounds write, potentially leading to code execution.
CVE-2025-62500 High · 7.1 CWE-125 Mar 17, 2026
Out-of-bounds Read in Canva Affinity
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
CVE-2025-62403 High · 7.1 CWE-125 Mar 17, 2026
Out-of-bounds Read in Canva Affinity
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
CVE-2025-61979 High · 7.1 CWE-125 Mar 17, 2026
Out-of-bounds Read in Canva Affinity
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
CVE-2025-61952 High · 7.1 CWE-125 Mar 17, 2026
Out-of-bounds Read in Canva Affinity
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
CVE-2025-58427 High · 7.1 CWE-125 Mar 17, 2026
Out-of-bounds Read in Canva Affinity
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.