Talos Vulnerability Report

SUMMARY

An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.

CONFIRMED VULNERABLE VERSIONS

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

Canva Affinity 3.0.1.3808

PRODUCT URLS

Affinity - https://www.affinity.studio/

CVSSv3 SCORE

6.1 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

CWE

CWE-125 - Out-of-bounds Read

DETAILS

Affinity is a professional and versatile suite of creative applications designed for graphic design, photo editing, and desktop publishing. It provides a fast, streamlined experience with powerful tools to create illustrations, edit images, and design print or digital layouts. The suite is widely regarded as a capable and affordable alternative the software like Adobe Creative Cloud.

Affinity applications support the EMF file format, and this vulnerability is associated with how EMF files are processed.

An EMF (Enhanced Metafile Format) file stores images in a device-independent form. It begins with a header (EMR_HEADER) that contains information about the structure and contents of the metafile. The structure of the EMR_HEADER is as follows:

Offset      Size      Name
------      ---- --------------------------------------
0x00        0x04            recordType  (0x00000001 )
0x04        0x04            recordSize
0x08        0x10            bounds
0x18        0x10            frame
0x28        0x04            recordSignature (0x464D4520)
0x2C        0x04            version
0x30        0x04            sizeInBytes
0x34        0x04            numOfRecords
0x38        0x02            Handles
0x3A        0x02            Reserved

Please note that the structure of EMR_HEADER shown is not complete; it only includes the relevant fields.

For the EMR_HEADER record, the recordType must be 0x00000001. The recordSize indicates the total size of the header record in bytes. The recordSignature field defines the record signature, which must have the value 0x464D4520 (FME ). The sizeInBytes field specifies the size of the metafile in bytes. The numOfRecords indicates the total number of records present in the metafile, including the EMR_HEADER.

This vulnerability is associated with the record type EMR_CREATEDIBPATTERNBRUSHPT.

The EMR_CREATEDIBPATTERNBRUSHPT record defines a pattern brush for graphics operations. The structure of the EMR_CREATEDIBPATTERNBRUSHPT record is as follows:

Offset     Size      Name
-----   ---------- --------------------------------------
0x00        0x04        recordType  (0x0000005E )
0x04        0x04        recordSize
0x08        0x04        ihBrush
0x0C        0x04        Usage
0x10        0x04        offBmi (n)
0x14        0x04        cbBmi   (p)
0x18        0x04        offBits 
0x20        0x04        cbBits  (q)
n           p+q         BitmapBuffer

For the EMR_CREATEDIBPATTERNBRUSHPT record, the recordType value must be 0x0000005E. The offBmi field indicates the offset from the start of this record to the DIB header, and the cbBmi field specifies the size of the DIB header. The offBits field indicates the offset from the start of this record to the DIB bits, and the cbBits field specifies the size of the DIB bits.

This vulnerability occurs when the value of offBmi is greater than the recordSize field, which can result in an out‑of‑bounds read when the DIB header is accessed. This behavior can be observed while debugging with pageheap enabled.

0:032> g
Breakpoint 1 hit
libpersona!Emf::EmfLoader::LoadDocument+0x44d17:
00007ffa`4ef12e97 e834e6ffff      call    libpersona!Emf::EmfLoader::LoadDocument+0x43350 (00007ffa`4ef114d0)
0:032> r
rax=0000761eaaafd16f rbx=000001d6d48305c4 rcx=00000020aa9ff390
rdx=000001d6d48305c4 rsi=000001d6d48305c4 rdi=00000020aa9ff2d0
rip=00007ffa4ef12e97 rsp=00000020aa9fef50 rbp=00000020aa9ff050
 r8=000001d9a4ef6fd0  r9=0000000000000006 r10=00000000ffffffef
r11=00000020aa9fedf0 r12=00007ffa4ef1fe80 r13=000001d6d4830000
r14=00000020aa9ff390 r15=0000000000000000
iopl=0         nv up ei pl zr na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
libpersona!Emf::EmfLoader::LoadDocument+0x44d17:
00007ffa`4ef12e97 e834e6ffff      call    libpersona!Emf::EmfLoader::LoadDocument+0x43350 (00007ffa`4ef114d0)
0:032> dd 000001d6d48305c4   ; <------------------------------------------------ (1)
000001d6`d48305c4  0000005e 00000158 00000004 00000000
000001d6`d48305d4  3738322d 0000002d 00000035 00000038
000001d6`d48305e4  00000039 05000039 00000037 00003930
000001d6`d48305f4  00005800 00010000 00000000 00002820
000001d6`d4830604  00000800 00000800 20000100 00000300
000001d6`d4830614  00010000 00000000 00000000 00000000
000001d6`d4830624  00000000 ff000000 00ff0000 0000ff00
000001d6`d4830634  00000000 00000000 00000000 00000000
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x44d1c:
00007ffa`4ef12e9c 8b5610          mov     edx,dword ptr [rsi+10h] ds:000001d6`d48305d4=3738322d ; <--------------------------------- (2)
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x44d1f:
00007ffa`4ef12e9f 4803d6          add     rdx,rsi ;<------------------------------- (3)
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x44d22:
00007ffa`4ef12ea2 448b4618        mov     r8d,dword ptr [rsi+18h] ds:000001d6`d48305dc=00000035
0:032> r
rax=000001d9ba9e0fd0 rbx=000001d6d48305c4 rcx=000001d6af810000
rdx=000001d70bbb37f1 rsi=000001d6d48305c4 rdi=00000020aa9ff2d0
rip=00007ffa4ef12ea2 rsp=00000020aa9fef50 rbp=00000020aa9ff050
 r8=0000000000000000  r9=0000000000000001 r10=00000000ffffffef
r11=00000020aa9fee50 r12=00007ffa4ef1fe80 r13=000001d6d4830000
r14=00000020aa9ff390 r15=0000000000000000
iopl=0         nv up ei pl nz ac pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000212
libpersona!Emf::EmfLoader::LoadDocument+0x44d22:
00007ffa`4ef12ea2 448b4618        mov     r8d,dword ptr [rsi+18h] ds:000001d6`d48305dc=00000035
0:032> dd 000001d70bbb37f1             ;<------------------------------- (4)
000001d7`0bbb37f1  ???????? ???????? ???????? ????????
000001d7`0bbb3801  ???????? ???????? ???????? ????????
000001d7`0bbb3811  ???????? ???????? ???????? ????????
000001d7`0bbb3821  ???????? ???????? ???????? ????????
000001d7`0bbb3831  ???????? ???????? ???????? ????????
000001d7`0bbb3841  ???????? ???????? ???????? ????????
000001d7`0bbb3851  ???????? ???????? ???????? ????????
000001d7`0bbb3861  ???????? ???????? ???????? ????????
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x44d26:
00007ffa`4ef12ea6 4c03c6          add     r8,rsi
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x44d29:
00007ffa`4ef12ea9 448b4e1c        mov     r9d,dword ptr [rsi+1Ch] ds:000001d6`d48305e0=00000038
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x44d2d:
00007ffa`4ef12ead 4d03c8          add     r9,r8
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x44d30:
00007ffa`4ef12eb0 4c897c2460      mov     qword ptr [rsp+60h],r15 ss:00000020`aa9fefb0=00000020aa9ff0a0
0:032> pc
libpersona!Emf::EmfLoader::LoadDocument+0x44d6b:
00007ffa`4ef12eeb e8e026a0ff      call    libpersona!Dib::RasterHelper::CreateDynamicBitmapFromDib (00007ffa`4e9155d0)

The contents of the EMR_CREATEDIBPATTERNBRUSHPT record are examined at (1). At (2), the offBmi value is read and added to the pointer at (3) to obtain the address pointing to the DIB header. However, the value of offBmi is not validated before accessing the DIB header, and in this case, offBmi is arbitrarily large. As a result, the computed address points to an unallocated memory region, as shown at (4). Accessing this memory region later in the program leads to an out‑of‑bounds read condition, which can be observed at the time of the crash.

:032> p
(1318.1270): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
libbmp!Bmp::FileInputStream::IsValid+0x20a0:
00007ffa`edf6355f 8b02            mov     eax,dword ptr [rdx] ds:000001d7`0bbb37f1=????????
0:032> dd 000001d7`0bbb37f1
000001d7`0bbb37f1  ???????? ???????? ???????? ????????
000001d7`0bbb3801  ???????? ???????? ???????? ????????
000001d7`0bbb3811  ???????? ???????? ???????? ????????
000001d7`0bbb3821  ???????? ???????? ???????? ????????
000001d7`0bbb3831  ???????? ???????? ???????? ????????
000001d7`0bbb3841  ???????? ???????? ???????? ????????
000001d7`0bbb3851  ???????? ???????? ???????? ????????
000001d7`0bbb3861  ???????? ???????? ???????? ????????
0:032> u
libbmp!Bmp::FileInputStream::IsValid+0x20a0:
00007ffa`edf6355f 8b02            mov     eax,dword ptr [rdx]
00007ffa`edf63561 4c8bda          mov     r11,rdx
00007ffa`edf63564 4c8bc9          mov     r9,rcx
00007ffa`edf63567 83f828          cmp     eax,28h
00007ffa`edf6356a 7215            jb      libbmp!Bmp::FileInputStream::IsValid+0x20c2 (00007ffa`edf63581)
00007ffa`edf6356c 448b5210        mov     r10d,dword ptr [rdx+10h]
00007ffa`edf63570 8b5220          mov     edx,dword ptr [rdx+20h]
00007ffa`edf63573 450fb7430e      movzx   r8d,word ptr [r11+0Eh]
0:032> kb
 # RetAddr               : Args to Child                                                           : Call Site
00 00007ffa`4e91563e     : 00000000`00000000 00000000`00000000 000001d9`ba9e0fd0 00000000`00000000 : libbmp!Bmp::FileInputStream::IsValid+0x20a0
01 00007ffa`4ef12ef0     : 000001d9`b3952fd0 000001d6`d48305c4 000001d6`d48305c4 000001d9`b3952fd0 : libpersona!Dib::RasterHelper::CreateDynamicBitmapFromDib+0x6e
02 00007ffa`4ef20fcf     : 000001d9`b9306fd0 000001d9`b86f3d20 000001d6`d48305c4 00000020`aa9ff1f1 : libpersona!Emf::EmfLoader::LoadDocument+0x44d70
03 00007ffa`4ef1fe9c     : 00000020`aa9ff390 00000000`000005c4 00000000`0000000f 000021d8`00000004 : libpersona!Emf::EmfLoader::LoadDocument+0x52e4f
04 00007ffa`faf0e73f     : 00000000`000005c4 000001d9`b86f3d20 000001d6`af810000 000001d6`af810000 : libpersona!Emf::EmfLoader::LoadDocument+0x51d1c
05 00007ffa`fc56d432     : 000001d9`b9306fd0 00000020`00000000 000001d9`b9306fd0 00000000`00000000 : gdi32full!bInternalPlayEMF+0x250bf
06 00007ffa`4ef215ce     : 00000000`00000000 00000020`aa9ff3f0 00000020`aa9ff670 000001d6`e9622f90 : GDI32!EnumEnhMetaFileStub+0x52
07 00007ffa`4eecdb56     : 00000020`aa9ff390 00000020`aa9ff320 00000000`00000000 00007ffa`fd881910 : libpersona!Emf::EmfLoader::LoadDocument+0x5344e
08 00007ffa`4eece041     : 000001d6`e9622f90 000001d9`b86f3d20 000001d6`e9622f90 00000020`aa9ff670 : libpersona!Emf::EmfLoader::LoadDocument+0x86
09 00007ffa`4eece2ab     : 00000020`aa9ff708 000001d6`e9622f90 00000020`aa9ff670 00000020`aa9ff720 : libpersona!Emf::EmfLoader::LoadDocument+0x101
0a 00007ffa`4eece124     : 000001d9`b6d05740 00000020`aa9ff708 00000020`aa9ff6d8 00000020`aa9ff751 : libpersona!Emf::EmfLoader::LoadDocument+0x12b
0b 00007ffa`4ec83a94     : 000001d9`902c0fa0 000001d9`b6d05740 00000020`aa9ff7b0 00000020`aa9ffa78 : libpersona!Emf::EmfLoader::LoadDocument+0x94
0c 00007ffa`4ec5088f     : 000001d9`b6d05740 00000000`00000000 00000000`00000000 00000000`ffffff00 : libpersona!DocumentController::TryLoadEMF+0xc4
0d 00007ffa`4ec4eacc     : 00000000`00000000 000001d9`00000001 00000000`00000000 00000000`00000000 : libpersona!DocumentController::LoadDocumentI+0xfaf
0e 00007ffa`51283602     : 000001d9`94a22690 00000000`00000000 000001d9`a4842f70 00000000`00000000 : libpersona!DocumentController::LoadDocument+0x8c
0f 00007ffa`52a96cea     : 000001d9`94a226c8 000001d9`a4ff6f00 00007ffa`af8c2800 00000000`00000000 : libpersona!LoadDocumentCommand::Do+0x252
10 00007ffa`af2464cf     : 00000000`00000000 000001d9`a4842f70 00000000`00000000 000001d9`80f06fe0 : libpersona!PersonaController::StaticDoCommand+0x3a
11 00007ffa`af49f47f     : 000001d9`bd7d8fd0 00000000`00000481 00000000`00000000 000001d9`a8c3ef90 : libkernel!Kernel::InSerialiserPropertyDataStream::LoadValues+0xb787f
12 00007ffa`fcc17374     : 00007ffa`af8c2800 00000000`00000000 00000000`00000000 00000000`00000000 : libkernel!Kernel::InSerialiserPropertyDataStream::LoadValues+0x31082f
13 00007ffa`fd87cc91     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x14
14 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21
0:032> lmDvm libpersona
Browse full module list
start             end                 module name
00007ffa`49180000 00007ffa`60abb000   libpersona   (export symbols)       C:\Program Files\WindowsApps\Canva.Affinity_3.0.1.3808_x64__8a0j1tnjnt4a4\App\libpersona.dll
    Loaded symbol image file: C:\Program Files\WindowsApps\Canva.Affinity_3.0.1.3808_x64__8a0j1tnjnt4a4\App\libpersona.dll
    Image path: C:\Program Files\WindowsApps\Canva.Affinity_3.0.1.3808_x64__8a0j1tnjnt4a4\App\libpersona.dll
    Image name: libpersona.dll
    Browse all global symbols  functions  data  Symbol Reload
    Timestamp:        Mon Nov  3 07:34:40 2025 (6908CB90)
    CheckSum:         17822078
    ImageSize:        1793B000
    Mapping Form:     Loaded
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

Exploiting this vulnerability allows for the reading of arbitrary memory within the process, potentially disclosing sensitive information.

VENDOR RESPONSE

See security bulletin on trust.canva.com with the vulnerability details and vulnerable versions. (URL to advisory: https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62)

TIMELINE

2026-01-27 - Vendor Disclosure
2026-03-17 - Vendor Patch Release
2026-03-17 - Public Release