CVE-2025-64301
📋 TL;DR
An out-of-bounds write vulnerability in Canva Affinity's EMF file processing allows attackers to execute arbitrary code by tricking users into opening malicious EMF files. This affects all users of vulnerable Canva Affinity software versions. Successful exploitation could give attackers full control of the affected system.
💻 Affected Systems
- Canva Affinity Designer
- Canva Affinity Photo
- Canva Affinity Publisher
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with SYSTEM/root privileges leading to complete system compromise, data theft, ransomware deployment, or lateral movement within networks.
Likely Case
Local privilege escalation or arbitrary code execution in the context of the current user, potentially leading to credential theft, data exfiltration, or malware installation.
If Mitigated
Denial of service (application crash) if memory corruption doesn't lead to reliable code execution due to mitigations like ASLR/DEP.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). No public exploit code available at disclosure time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Canva Affinity update for latest security patch
Vendor Advisory: https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62
Restart Required: Yes
Instructions:
1. Open Canva Affinity application. 2. Go to Help > Check for Updates. 3. Install all available updates. 4. Restart the application.
🔧 Temporary Workarounds
Block EMF file extensions
allPrevent processing of EMF files at the system or network level
Disable EMF file association
windowsRemove Canva Affinity as default handler for EMF files
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized software execution
- Use email/web gateways to block EMF file attachments and downloads
🔍 How to Verify
Check if Vulnerable:
Check Canva Affinity version against patched version in vendor advisoryCheck Version:
Open Canva Affinity > Help > About (version displayed in dialog)Verify Fix Applied:
Verify application version matches or exceeds patched version, test with known safe EMF files📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening EMF files
- Unusual process spawning from Canva Affinity
Network Indicators:
- Downloads of EMF files from untrusted sources
- Outbound connections after opening EMF files
SIEM Query:
source="*canva*" OR process="*affinity*" AND (event_type="crash" OR file_extension=".emf")