CVE-2026-96396 in Affinity
Summary
by MITRE • 10/09/2026
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could corrupt heap memory and cause the thumbnail or preview extension to crash.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Affinity by Canva for macOS prior to version 3.3.1 represents a critical failure in input validation during the generation of QuickLook thumbnails and previews. This flaw stems from an integer overflow that occurs when the application calculates the required size of an image buffer. Specifically, the software fails to properly validate or handle large values associated with image dimensions or metadata within Affinity document files. When these malformed inputs are processed, the arithmetic operation used to determine buffer allocation wraps around due to limited data type capacity, resulting in a significantly smaller allocated memory region than what is actually required for rendering the preview. This miscalculation directly leads to a heap-based buffer overflow when the application attempts to write image data into the undersized buffer.
From a technical perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound and CWE-122 Heap-Based Buffer Overflow as defined by the Common Weakness Enumeration standards. The core issue lies in the lack of bounds checking before memory allocation and subsequent write operations. In macOS environments, QuickLook is an integral system service that allows users to preview files without opening them fully. By exploiting this flaw through a crafted Affinity document, an attacker can trigger the overflow within the context of the thumbnail or preview extension process. This mechanism bypasses many traditional application-level security controls because it operates during a passive user interaction phase where file metadata is parsed automatically by the operating system's graphical interface components rather than explicit user execution commands.
The operational impact of this vulnerability extends beyond simple application instability. While the immediate effect described involves memory corruption and crashes, heap-based buffer overflows are frequently precursors to more severe security breaches such as arbitrary code execution or privilege escalation depending on the specific exploitability conditions and system state at the time of exploitation. The crash of the thumbnail or preview extension can lead to denial-of-service conditions for users relying on QuickLook features, disrupting workflow efficiency. Furthermore, because macOS applications often run with user privileges that may extend to sensitive directories, successful exploitation could potentially allow a threat actor to inject malicious code into the running process context, leading to data exfiltration or further lateral movement within the local system environment.
Mitigation strategies for this vulnerability primarily involve immediate software updates and defensive configuration adjustments. Users must upgrade Affinity by Canva to version 3.3.1 or later where these integer overflow checks have been implemented and validated. In environments where patching is not immediately feasible, administrators should consider disabling QuickLook previews for specific file types associated with the application using macOS security policies or third-party endpoint detection tools that monitor memory allocation anomalies. Additionally, implementing strict input validation at the source code level during future development cycles, including the use of safe arithmetic libraries and rigorous fuzz testing against document parsers, is essential to prevent similar integer overflow vulnerabilities from being introduced into other components of the software suite.