CVE-2026-96395 in Affinity
Summary
by MITRE • 10/09/2026
The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory, including memory addresses, in the rendered thumbnail or preview image.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Affinity by Canva for macOS prior to version 3.3.1 represents a critical security flaw rooted in improper input validation during file processing operations. Specifically, the application fails to perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity document files. This technical deficiency allows an attacker who crafts a maliciously constructed Affinity document to trigger an out-of-bounds heap read operation. The core issue lies in the memory management logic used by the thumbnail generation subsystem, which does not correctly verify that data access requests remain within the allocated boundaries of the buffer being processed. When such a crafted file is encountered, the application attempts to read from memory locations adjacent to the intended target area, resulting in the disclosure of sensitive heap contents.
The operational impact of this vulnerability centers on information leakage through the macOS QuickLook interface. Because the flaw manifests during the generation of visual previews and thumbnails within Finder or other applications that utilize QuickLook, a threat actor can exploit it simply by convincing a user to view a malicious file's preview. The consequence is not immediate code execution but rather the disclosure of adjacent heap memory contents. This disclosed data may include internal application state information, stack pointers, or other memory addresses embedded in the heap structure. Such leakage significantly aids attackers in performing further exploitation techniques, particularly those requiring knowledge of memory layout to bypass security mitigations like Address Space Layout Randomization (ASLR). By obtaining these memory addresses, an attacker can gain valuable insights into the runtime environment, facilitating more precise and reliable subsequent attacks such as arbitrary code execution or privilege escalation.
From a classification perspective, this vulnerability aligns with CWE-125, which describes Out-of-bounds Read vulnerabilities where software reads data past the end of, or before the beginning of, the intended buffer. The exploitation vector is classified under ATT&CK technique T1083, specifically File and Directory Discovery, as it involves accessing files to extract information, although the primary impact here is memory disclosure rather than file listing. Furthermore, this falls within the broader category of CWE-200, which covers Exposure of Sensitive Information to an Unauthorized Actor. The attack requires minimal user interaction beyond viewing a preview, making it particularly dangerous in environments where users frequently browse directories containing untrusted or shared documents.
Mitigation strategies for this vulnerability primarily involve updating the Affinity by Canva application to version 3.3.1 or later, which addresses the bounds checking deficiency in the thumbnail generation module. Until an update is applied, users should exercise extreme caution when opening preview files from unknown sources and consider disabling QuickLook previews for untrusted directories if possible through system settings. Security teams should also monitor for anomalous memory access patterns related to Affinity processes using endpoint detection tools capable of tracing heap operations. Additionally, implementing strict input validation policies in software development lifecycles can prevent similar out-of-bounds read issues by ensuring that all buffer accesses are verified against allocated limits before execution.