CVE-2025-66042
📋 TL;DR
An out-of-bounds read vulnerability in Canva Affinity's EMF file processing allows attackers to read memory beyond allocated buffers via specially crafted EMF files. This could lead to sensitive information disclosure from the application's memory space. Users of Canva Affinity software are affected.
💻 Affected Systems
- Canva Affinity
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Disclosure of sensitive information from application memory, potentially including authentication tokens, user data, or system information that could facilitate further attacks.
Likely Case
Information disclosure of limited memory contents, potentially revealing application state or partial data fragments.
If Mitigated
No impact if proper controls prevent malicious EMF file execution or if patched version is used.
🎯 Exploit Status
Exploitation requires user interaction to open malicious EMF file, but no authentication is needed once file is opened.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Canva Affinity updates for specific version
Vendor Advisory: https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62
Restart Required: Yes
Instructions:
1. Open Canva Affinity application
2. Navigate to Help > Check for Updates
3. Install available updates
4. Restart the application
🔧 Temporary Workarounds
Disable EMF file processing
allPrevent Affinity from processing EMF files by modifying file associations or using application restrictions
User education and file filtering
allTrain users to avoid opening EMF files from untrusted sources and implement email/web filtering for EMF attachments
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized Affinity execution
- Use endpoint protection with memory protection features enabled
🔍 How to Verify
Check if Vulnerable:
Check Affinity version against patched version in vendor advisoryCheck Version:
In Affinity: Help > About (Windows) or Affinity [Product] > About Affinity [Product] (macOS)Verify Fix Applied:
Verify Affinity version is updated to patched version and test with known safe EMF files📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing EMF files
- Unusual memory access patterns in application logs
Network Indicators:
- Downloads of EMF files from untrusted sources
- Unusual outbound connections after EMF file processing
SIEM Query:
source="*affinity*" AND (event="crash" OR event="error") AND file_extension="emf"