CVE-2025-66617 in Affinity
Summary
by MITRE • 03/17/2026
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/21/2026
The vulnerability identified as CVE-2025-66617 represents a critical out-of-bounds read flaw within the EMF (Enhanced Metafile) processing component of Canva Affinity software. This issue stems from insufficient input validation and boundary checking mechanisms when parsing EMF file formats, which are commonly used for vector graphics and document rendering within the application. The vulnerability manifests when the software attempts to read memory locations beyond the allocated buffer boundaries during EMF file processing, creating potential attack vectors for malicious actors seeking to exploit this weakness.
The technical implementation of this vulnerability involves the improper handling of EMF file structures where the application fails to validate the size and boundaries of data segments within the metafile format. When processing a specially crafted EMF file, the parsing routine does not adequately verify the integrity of the file structure, allowing an attacker to manipulate the file contents in such a way that subsequent memory access operations traverse unauthorized memory regions. This type of flaw falls under the CWE-125 vulnerability category, which specifically addresses out-of-bounds read conditions in software implementations. The vulnerability is particularly concerning as it operates at the binary parsing level where memory corruption can lead to information disclosure rather than direct execution exploits.
The operational impact of this vulnerability extends beyond simple information disclosure, as the out-of-bounds read could potentially expose sensitive data residing in adjacent memory segments including user credentials, session tokens, or application configuration details. Attackers could leverage this vulnerability by delivering malicious EMF files through various attack vectors such as email attachments, web downloads, or collaborative sharing within the Canva Affinity platform. The exploitation process requires minimal privileges and could be automated, making it particularly dangerous in enterprise environments where document sharing and collaboration are common practices. This vulnerability aligns with ATT&CK technique T1059.007 for process injection and T1566 for spearphishing with a malicious file, as it enables attackers to establish persistent access through document-based delivery methods.
Mitigation strategies for CVE-2025-66617 should prioritize immediate patch deployment from Canva Affinity vendors, while implementing defensive measures such as strict file validation policies and sandboxed processing environments for EMF files. Organizations should establish network-level controls to monitor and restrict EMF file transfers, particularly in high-risk environments where sensitive information is prevalent. Additionally, implementing application whitelisting policies and regular security assessments of document processing components can significantly reduce the attack surface. The vulnerability highlights the importance of robust input validation and memory safety practices in graphics processing libraries, emphasizing the need for comprehensive security testing of third-party components and regular vulnerability assessments to prevent similar issues in other software applications.