CVE-2026-103220 in Affinity
Summary
by MITRE • 10/09/2026
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and the dereference of an untrusted pointer. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in memory corruption or an application crash.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Affinity by Canva prior to version 3.3.1 represents a critical security flaw rooted in improper input validation during the processing of raster image data within Affinity document files. This issue manifests as an out-of-bounds read, which occurs when the application fails to perform adequate bounds checking on the indices or offsets used to access memory regions containing image pixel data. In software development, particularly in applications handling complex media formats like vector and raster graphics, it is imperative that all array accesses are validated against the allocated buffer size. The absence of such checks allows a crafted input file to specify coordinates or lengths that exceed the boundaries of the intended memory allocation. When the application attempts to read from these invalid addresses, it triggers an out-of-bounds read condition, which falls under CWE-125 in the Common Weakness Enumeration standard. This specific weakness is particularly dangerous because reading beyond allocated buffers can expose sensitive data stored adjacent to the buffer or cause undefined behavior depending on how the operating system handles memory protection for that region.
The operational impact of this vulnerability extends beyond simple application instability, although a crash remains a likely immediate consequence. By crafting an Affinity document with maliciously constructed image metadata, a threat actor can force the application to dereference an untrusted pointer or access unmapped memory pages. This scenario aligns with CWE-126, which covers buffer over-read vulnerabilities that may lead to information disclosure if the out-of-bounds data contains sensitive values such as stack pointers, heap metadata, or other process-specific secrets. Furthermore, in certain execution environments or when combined with other exploitation techniques, this memory corruption can potentially be leveraged for arbitrary code execution, although the primary reported risk is denial of service through application crashes and potential information leakage. The attack vector requires user interaction, specifically the opening of a maliciously crafted file, which classifies this as CWE-20 regarding improper input validation where external data influences program flow without sufficient sanitization or verification.
From an offensive security perspective, this vulnerability can be mapped to techniques observed in real-world attacks and documented within the MITRE ATT&CK framework. The initial access phase involves tricking a user into opening a malicious file, which corresponds to T1566.001 Phishing: Spearphishing Attachment or more broadly T1204 User Execution if delivered via other means such as drive-by downloads or social engineering campaigns that result in local file execution. The exploitation of the out-of-bounds read itself relates to memory corruption techniques often associated with privilege escalation or remote code execution attempts, though in this specific instance, it primarily serves as a mechanism for denial of service and potential information gathering. Security analysts should note that such vulnerabilities are frequently exploited in zero-day campaigns targeting creative professionals who may be less vigilant about the source integrity of design files received from external collaborators.
To mitigate the risks associated with this vulnerability, organizations and individual users must ensure that Affinity by Canva is updated to version 3.3.1 or later as soon as possible. This update includes the necessary patches for bounds checking logic within the raster image parsing engine. In addition to applying vendor-provided updates, security teams should implement strict file intake policies if this software is used in enterprise environments where files are received from untrusted sources. Techniques such as sandboxing the application execution environment can limit the impact of a successful exploit by isolating memory access violations and preventing them from affecting other system processes or sensitive data stores. Furthermore, enabling automatic updates ensures that users remain protected against newly disclosed vulnerabilities without requiring manual intervention. Regular security awareness training should also be conducted to educate employees on the risks associated with opening design files from unknown origins, reinforcing the principle of least privilege by ensuring applications run with minimal necessary permissions and do not have unrestricted access to sensitive system resources.