CVE-2025-64301 in Affinity
Summary
by MITRE • 03/17/2026
An out‑of‑bounds write vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out‑of‑bounds write, potentially leading to code execution.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 03/21/2026
The vulnerability identified as CVE-2025-64301 represents a critical out-of-bounds write flaw within the Enhanced Metafile Format (EMF) processing component of Canva Affinity software. This issue stems from insufficient input validation and memory management when handling specially crafted EMF files, creating a pathway for malicious actors to manipulate memory structures beyond their intended boundaries. The vulnerability exists in the software's graphics rendering pipeline where EMF files are parsed and interpreted, making it particularly dangerous given the widespread use of vector graphics in design applications.
The technical implementation of this flaw involves the improper handling of EMF file structures during parsing operations, specifically when processing metafile records that define drawing operations. When an attacker supplies a malicious EMF file containing malformed or oversized data structures, the application fails to validate buffer boundaries before writing data to memory locations. This memory corruption occurs at the level of the graphics processing engine, where the software attempts to write data to memory regions that extend beyond allocated buffers, potentially overwriting adjacent memory segments including function pointers, return addresses, or other critical program data structures. The vulnerability is classified as CWE-787 Out-of-bounds Write within the Common Weakness Enumeration framework, which directly maps to the core flaw in memory management.
The operational impact of this vulnerability extends beyond simple memory corruption, as it creates a potential code execution vector that could be leveraged by threat actors. An attacker who successfully exploits this vulnerability could gain arbitrary code execution within the context of the Canva Affinity application, potentially allowing for privilege escalation, data exfiltration, or system compromise. The attack surface is particularly concerning given that EMF files are commonly shared in design workflows, making this vulnerability exploitable through social engineering or supply chain compromise scenarios. The vulnerability aligns with ATT&CK technique T1059.007 Command and Scripting Interpreter: Visual Basic, as it could enable attackers to execute malicious code through manipulated graphics files that are opened within the vulnerable application environment.
Mitigation strategies for CVE-2025-64301 should prioritize immediate patch management from Canva Affinity vendors, as the most effective solution involves correcting the buffer overflow conditions through proper input validation and memory boundary checks. Organizations should implement strict file validation policies that scan and quarantine suspicious EMF files before processing, while also considering network-level restrictions that prevent the automatic execution of graphics files from untrusted sources. Security teams should monitor for indicators of compromise related to this vulnerability through endpoint detection and response systems, paying particular attention to anomalous memory access patterns or unexpected code execution within the Affinity application. Additionally, users should be educated about the risks of opening untrusted graphics files and the importance of maintaining current software versions to protect against known vulnerabilities in their design applications.