Talos Vulnerability Report

SUMMARY

An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.

CONFIRMED VULNERABLE VERSIONS

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

Canva Affinity 3.0.1.3808

PRODUCT URLS

Affinity - https://www.affinity.studio/

CVSSv3 SCORE

6.1 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

CWE

CWE-125 - Out-of-bounds Read

DETAILS

Affinity is a professional and versatile suite of creative applications designed for graphic design, photo editing, and desktop publishing. It provides a fast, streamlined experience with powerful tools to create illustrations, edit images, and design print or digital layouts. The suite is widely regarded as a capable and affordable alternative the software like Adobe Creative Cloud.

Affinity applications support the EMF file format, and this vulnerability is associated with how EMF files are processed.

An EMF (Enhanced Metafile Format) file stores images in a device-independent form. It begins with a header (EMR_HEADER) that contains information about the structure and contents of the metafile. The structure of the EMR_HEADER is as follows:

Offset      Size      Name
------      ---- --------------------------------------
0x00        0x04            recordType  (0x00000001 )
0x04        0x04            recordSize
0x08        0x10            bounds
0x18        0x10            frame
0x28        0x04            recordSignature (0x464D4520)
0x2C        0x04            version
0x30        0x04            sizeInBytes
0x34        0x04            numOfRecords
0x38        0x02            Handles
0x3A        0x02            Reserved

Please note that the structure of EMR_HEADER shown is not complete; it only includes the relevant fields.

For the EMR_HEADER record, the recordType must be 0x00000001. The recordSize indicates the total size of the header record in bytes. The recordSignature field defines the record signature, which must have the value 0x464D4520 (FME ). The sizeInBytes field specifies the size of the metafile in bytes. The numOfRecords indicates the total number of records present in the metafile, including the EMR_HEADER.

This vulnerability is associated with the record type EMR_POLYGON.

The EMR_POLYGON record specifies a polygon. Its structure is defined as follows:

 Offset     Size      Name
-----   ---------- --------------------------------------
0x00         0x04        recordType  (0x00000003)
0x04         0x04        recordSize
0x08         0x10        Bounds
0x18         0x04        Count (N)
0x1C         0x08*N      aPoints 

For the EMR_POLYGON record, the recordType value must be 0x00000003. The Count field specifies the number of PointL objects in the aPoints field. The aPoints field is an array whose size is equal to Count.

This vulnerability occurs when the value of (0x1C + (8 * N)) exceeds recordSize. When this condition is met, an out‑of‑bounds read can occur during access to the aPoints array. This behavior can be observed while debugging with pageheap enabled.

0:032> g
Breakpoint 1 hit
libpersona!Emf::EmfLoader::LoadDocument+0x4b0de:
00007ffa`4ef1925e 4c8bf9          mov     r15,rcx
0:032> r
rax=00007ffa5d93ada0 rbx=000001d6d4830118 rcx=00000020aa9ff390
rdx=000001d6d4830118 rsi=000001d9aa8f0d20 rdi=00000020aa9ff2d0
rip=00007ffa4ef1925e rsp=00000020aa9feff0 rbp=00000020aa9ff060
 r8=000001d9beffeff0  r9=0000000000000002 r10=0000000000000000
r11=00000020aa9fef60 r12=00007ffa4ef1fe80 r13=000001d6d4830000
r14=000001d6d4830118 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000206
libpersona!Emf::EmfLoader::LoadDocument+0x4b0de:
00007ffa`4ef1925e 4c8bf9          mov     r15,rcx
0:032> dd 000001d6d4830118  ;<--------------------------------- (1)
000001d6`d4830118  00000003 00000114 0000002d 80c0031c
000001d6`d4830128  01000f00 000bbe00 00001f00 00006400
000001d6`d4830138  0007d000 00003300 ffffbe00 000066ff
000001d6`d4830148  00007e00 00009900 ffff5600 0000ccff
000001d6`d4830158  0000c400 00010200 ffff3c00 000135ff
000001d6`d4830168  0000ae00 00016800 ffff7c00 00019bff
000001d6`d4830178  00004a00 0001d100 fffffa00 000204ff
000001d6`d4830188  ffffc400 000237ff 00007800 00026a00
0:032> p;r
rax=00007ffa5d93ada0 rbx=000001d6d4830118 rcx=00000020aa9ff390
rdx=000001d6d4830118 rsi=000001d9aa8f0d20 rdi=00000020aa9ff2d0
rip=00007ffa4ef19261 rsp=00000020aa9feff0 rbp=00000020aa9ff060
 r8=000001d9beffeff0  r9=0000000000000002 r10=0000000000000000
r11=00000020aa9fef60 r12=00007ffa4ef1fe80 r13=000001d6d4830000
r14=000001d6d4830118 r15=00000020aa9ff390
iopl=0         nv up ei pl nz na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000206
libpersona!Emf::EmfLoader::LoadDocument+0x4b0e1:
00007ffa`4ef19261 e86a82ffff      call    libpersona!Emf::EmfLoader::LoadDocument+0x43350 (00007ffa`4ef114d0)
0:032> p;r
rax=000001d996815fd0 rbx=000001d6d4830118 rcx=000001d6af810000
rdx=000001d6af810000 rsi=000001d9aa8f0d20 rdi=00000020aa9ff2d0
rip=00007ffa4ef19266 rsp=00000020aa9feff0 rbp=00000020aa9ff060
 r8=0000000000000001  r9=0000000000000001 r10=00000000ffffffef
r11=00000020aa9feef0 r12=00007ffa4ef1fe80 r13=000001d6d4830000
r14=000001d6d4830118 r15=00000020aa9ff390
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000202
libpersona!Emf::EmfLoader::LoadDocument+0x4b0e6:
00007ffa`4ef19266 0f57c0          xorps   xmm0,xmm0
0:032> bp 00007FFA4EF19316 
0:032> g
Breakpoint 2 hit
libpersona!Emf::EmfLoader::LoadDocument+0x4b196:
00007ffa`4ef19316 4533ed          xor     r13d,r13d
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x4b199:
00007ffa`4ef19319 45396e18        cmp     dword ptr [r14+18h],r13d ds:000001d6`d4830130=00001f00  ;<--------------------------------- (2)
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x4b19d:
00007ffa`4ef1931d 0f8665010000    jbe     libpersona!Emf::EmfLoader::LoadDocument+0x4b308 (00007ffa`4ef19488) [br=0]
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x4b1a3:
00007ffa`4ef19323 4d8d661c        lea     r12,[r14+1Ch] ;<--------------------------------- (3)
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x4b1a7:
00007ffa`4ef19327 48baffffffffffffff0f mov rdx,0FFFFFFFFFFFFFFFh
0:032> r
rax=000001d9bb224fe0 rbx=000001d9bb224fe0 rcx=0000000000000000
rdx=0000000000000000 rsi=000000000001f000 rdi=000001d9bb224fe0
rip=00007ffa4ef19327 rsp=00000020aa9feff0 rbp=00000020aa9ff060
 r8=000001d9bb243fe0  r9=00007ffafa1e120e r10=00007ffafa1d0000
r11=0000000000000246 r12=000001d6d4830134 r13=0000000000000000
r14=000001d6d4830118 r15=00000020aa9ff390
iopl=0         nv up ei pl nz na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000206
libpersona!Emf::EmfLoader::LoadDocument+0x4b1a7:
00007ffa`4ef19327 48baffffffffffffff0f mov rdx,0FFFFFFFFFFFFFFFh
0:032> dd 000001d6d4830134
000001d6`d4830134  00006400 0007d000 00003300 ffffbe00
000001d6`d4830144  000066ff 00007e00 00009900 ffff5600
000001d6`d4830154  0000ccff 0000c400 00010200 ffff3c00
000001d6`d4830164  000135ff 0000ae00 00016800 ffff7c00
000001d6`d4830174  00019bff 00004a00 0001d100 fffffa00
000001d6`d4830184  000204ff ffffc400 000237ff 00007800
000001d6`d4830194  00026a00 ffff5a00 0002a0ff 0000c200
000001d6`d48301a4  0002d300 ffff3a00 000306ff 0000b200
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x4b1b1:
00007ffa`4ef19331 488b4548        mov     rax,qword ptr [rbp+48h] ss:00000020`aa9ff0a8=000001d6d4830118
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x4b1b5:
00007ffa`4ef19335 66410f6e742404  movd    xmm6,dword ptr [r12+4] ds:000001d6`d4830138=0007d000 ;<--------------------------------- (4)
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x4b1bc:
00007ffa`4ef1933c f30fe6f6        cvtdq2pd xmm6,xmm6
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x4b1c0:
00007ffa`4ef19340 66410f6e3c24    movd    xmm7,dword ptr [r12] ds:000001d6`d4830134=00006400 ;<--------------------------------- (5)
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x4b1c6:
00007ffa`4ef19346 f30fe6ff        cvtdq2pd xmm7,xmm7
0:032> u
libpersona!Emf::EmfLoader::LoadDocument+0x4b1c6:
00007ffa`4ef19346 f30fe6ff        cvtdq2pd xmm7,xmm7
00007ffa`4ef1934a 4c8bf3          mov     r14,rbx
00007ffa`4ef1934d 493bd8          cmp     rbx,r8
00007ffa`4ef19350 741e            je      libpersona!Emf::EmfLoader::LoadDocument+0x4b1f0 (00007ffa`4ef19370)
00007ffa`4ef19352 f20f113b        movsd   mmword ptr [rbx],xmm7
00007ffa`4ef19356 f20f117308      movsd   mmword ptr [rbx+8],xmm6
00007ffa`4ef1935b 488b5dc8        mov     rbx,qword ptr [rbp-38h]
00007ffa`4ef1935f 4883c310        add     rbx,10h

The contents of the EMR_POLYGON record are examined at (1). At (2), it is verified that Count is non‑zero. If so, the address of the memory containing aPoints is obtained at (3). A loop begins at (4) that runs Count times and reads PointL objects at (4) and (5). In this situation, the Count value is excessively large, and continuing the loop leads to an out‑of‑bounds read, which is visible at the time of the crash.

0:032> g
(1318.1270): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
libpersona!Emf::EmfLoader::LoadDocument+0x4b1b5:
00007ffa`4ef19335 66410f6e742404  movd    xmm6,dword ptr [r12+4] ds:000001d6`d4831000=????????
0:032> dd 000001d6`d4831000
000001d6`d4831000  ???????? ???????? ???????? ????????
000001d6`d4831010  ???????? ???????? ???????? ????????
000001d6`d4831020  ???????? ???????? ???????? ????????
000001d6`d4831030  ???????? ???????? ???????? ????????
000001d6`d4831040  ???????? ???????? ???????? ????????
000001d6`d4831050  ???????? ???????? ???????? ????????
000001d6`d4831060  ???????? ???????? ???????? ????????
000001d6`d4831070  ???????? ???????? ???????? ????????

0:032> u
libpersona!Emf::EmfLoader::LoadDocument+0x4b1b5:
00007ffa`4ef19335 66410f6e742404  movd    xmm6,dword ptr [r12+4]
00007ffa`4ef1933c f30fe6f6        cvtdq2pd xmm6,xmm6
00007ffa`4ef19340 66410f6e3c24    movd    xmm7,dword ptr [r12]
00007ffa`4ef19346 f30fe6ff        cvtdq2pd xmm7,xmm7
00007ffa`4ef1934a 4c8bf3          mov     r14,rbx
00007ffa`4ef1934d 493bd8          cmp     rbx,r8
00007ffa`4ef19350 741e            je      libpersona!Emf::EmfLoader::LoadDocument+0x4b1f0 (00007ffa`4ef19370)
00007ffa`4ef19352 f20f113b        movsd   mmword ptr [rbx],xmm7

0:032> kb 
 # RetAddr               : Args to Child                                                           : Call Site
00 00007ffa`4ef1ff5b     : 00000020`aa9ff390 000001d6`d4830118 000001d6`d4830118 00000020`aa9ff1f1 : libpersona!Emf::EmfLoader::LoadDocument+0x4b1b5
01 00007ffa`4ef1fe9c     : 00000020`aa9ff390 00000000`00000118 00000000`0000000f 000021d8`00000004 : libpersona!Emf::EmfLoader::LoadDocument+0x51ddb
02 00007ffa`faf0e73f     : 00000000`00000118 000001d9`aa8f0d20 000001d6`af810000 000001d6`af810000 : libpersona!Emf::EmfLoader::LoadDocument+0x51d1c
03 00007ffa`fc56d432     : 000001d9`b1f04fd0 00000020`00000000 000001d9`b1f04fd0 00000000`00000000 : gdi32full!bInternalPlayEMF+0x250bf
04 00007ffa`4ef215ce     : 00000000`00000000 00000020`aa9ff3f0 00000020`aa9ff670 000001d9`adeb4f90 : GDI32!EnumEnhMetaFileStub+0x52
05 00007ffa`4eecdb56     : 00000020`aa9ff390 00000020`aa9ff320 00000000`00000000 00007ffa`fd881910 : libpersona!Emf::EmfLoader::LoadDocument+0x5344e
06 00007ffa`4eece041     : 000001d9`adeb4f90 000001d9`aa8f0d20 000001d9`adeb4f90 00000020`aa9ff670 : libpersona!Emf::EmfLoader::LoadDocument+0x86
07 00007ffa`4eece2ab     : 00000020`aa9ff708 000001d9`adeb4f90 00000020`aa9ff670 00000020`aa9ff720 : libpersona!Emf::EmfLoader::LoadDocument+0x101
08 00007ffa`4eece124     : 000001d9`adde9740 00000020`aa9ff708 00000020`aa9ff6d8 00000020`aa9ff751 : libpersona!Emf::EmfLoader::LoadDocument+0x12b
09 00007ffa`4ec83a94     : 000001d9`bc0f0fb0 000001d9`adde9740 00000020`aa9ff7b0 00000020`aa9ffa78 : libpersona!Emf::EmfLoader::LoadDocument+0x94
0a 00007ffa`4ec5088f     : 000001d9`adde9740 00000000`00000000 00000000`00000000 00000000`ffffff00 : libpersona!DocumentController::TryLoadEMF+0xc4
0b 00007ffa`4ec4eacc     : 00000000`00000000 000001d8`00000001 00000000`00000000 00000000`00000000 : libpersona!DocumentController::LoadDocumentI+0xfaf
0c 00007ffa`51283602     : 000001d9`87436690 00000000`00000000 000001d9`9a64ef70 00000000`00000000 : libpersona!DocumentController::LoadDocument+0x8c
0d 00007ffa`52a96cea     : 000001d9`874366c8 000001d9`c1a66f00 00007ffa`af8c2800 00000000`00000000 : libpersona!LoadDocumentCommand::Do+0x252
0e 00007ffa`af2464cf     : 00000000`00000000 000001d9`9a64ef70 00000000`00000000 000001d9`bb858fe0 : libpersona!PersonaController::StaticDoCommand+0x3a
0f 00007ffa`af49f47f     : 000001d9`990b8fd0 00000000`00000481 00000000`00000000 000001d9`a8c3ef90 : libkernel!Kernel::InSerialiserPropertyDataStream::LoadValues+0xb787f
10 00007ffa`fcc17374     : 00007ffa`af8c2800 00000000`00000000 00000000`00000000 00000000`00000000 : libkernel!Kernel::InSerialiserPropertyDataStream::LoadValues+0x31082f
11 00007ffa`fd87cc91     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x14
12 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21

0:032> lmdDvm libpersona
Unknown option 'd'
Browse full module list
start             end                 module name
00007ffa`49180000 00007ffa`60abb000   libpersona   (export symbols)       C:\Program Files\WindowsApps\Canva.Affinity_3.0.1.3808_x64__8a0j1tnjnt4a4\App\libpersona.dll
    Loaded symbol image file: C:\Program Files\WindowsApps\Canva.Affinity_3.0.1.3808_x64__8a0j1tnjnt4a4\App\libpersona.dll
    Image path: C:\Program Files\WindowsApps\Canva.Affinity_3.0.1.3808_x64__8a0j1tnjnt4a4\App\libpersona.dll
    Image name: libpersona.dll
    Browse all global symbols  functions  data  Symbol Reload
    Timestamp:        Mon Nov  3 07:34:40 2025 (6908CB90)
    CheckSum:         17822078
    ImageSize:        1793B000
    Mapping Form:     Loaded
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:

Exploiting this vulnerability allows for the reading of arbitrary memory within the process, potentially disclosing sensitive information.

VENDOR RESPONSE

See security bulletin on trust.canva.com with the vulnerability details and vulnerable versions. (URL to advisory: https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62)

TIMELINE

2026-01-27 - Vendor Disclosure
2026-03-17 - Vendor Patch Release
2026-03-17 - Public Release