CVE-2025-62403
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.
Canva Affinity 3.0.1.3808
Affinity - https://www.affinity.studio/
6.1 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
CWE-125 - Out-of-bounds Read
Affinity is a professional and versatile suite of creative applications designed for graphic design, photo editing, and desktop publishing. It provides a fast, streamlined experience with powerful tools to create illustrations, edit images, and design print or digital layouts. The suite is widely regarded as a capable and affordable alternative the software like Adobe Creative Cloud.
Affinity applications support the EMF file format, and this vulnerability is associated with how EMF files are processed.
An EMF (Enhanced Metafile Format) file stores images in a device-independent form. It begins with a header (EMR_HEADER) that contains information about the structure and contents of the metafile. The structure of the EMR_HEADER is as follows:
Offset Size Name
------ ---- --------------------------------------
0x00 0x04 recordType (0x00000001 )
0x04 0x04 recordSize
0x08 0x10 bounds
0x18 0x10 frame
0x28 0x04 recordSignature (0x464D4520)
0x2C 0x04 version
0x30 0x04 sizeInBytes
0x34 0x04 numOfRecords
0x38 0x02 Handles
0x3A 0x02 Reserved
Please note that the structure of EMR_HEADER shown is not complete; it only includes the relevant fields.
For the EMR_HEADER record, the recordType must be 0x00000001. The recordSize indicates the total size of the header record in bytes. The recordSignature field defines the record signature, which must have the value 0x464D4520 (FME ). The sizeInBytes field specifies the size of the metafile in bytes. The numOfRecords indicates the total number of records present in the metafile, including the EMR_HEADER.
This vulnerability is associated with the record type EMR_EXTTEXTOUTA.
The EMR_EXTTEXTOUTA record specifies a ASCII text string using font and text colors. Its structure is defined as follows:
Offset Size Name
----- ---------- --------------------------------------
0x00 0x04 recordType (0x00000053 )
0x04 0x04 recordSize
0x08 0x10 Bounds
0x18 0x04 iGraphicsMode
0x1C 0x04 exScale
0x20 0x04 eyScale
0x24 0x08 Reference
0x2C 0x04 Chars
0x30 0x04 offString
0x34 0x04 Options
0x38 0x10 Rectangle
0x48 0x04 offDx
0x4C y StringBuffer
0x4C+y z DxBuffer
For the EMR_EXTTEXTOUTA record, the recordType value must be 0x00000053. The vulnerable field is the offDx field which indicates the offset from the start of this record to an intercharacter spacing array.
This vulnerability occurs when the value of (offDx+ (Chars *4)) is greater than recordSize. When this happens, an out‑of‑bounds read occurs when the intercharacter spacing array is accessed. This behavior can be observed while debugging with pageheap enabled.
0:032> g
Breakpoint 1 hit
libpersona!Emf::EmfLoader::LoadDocument+0x45e5b:
00007ffa`4ef13fdb 4533f6 xor r14d,r14d
0:032> r
rax=00000020aa9ff098 rbx=000001d6d48301e4 rcx=00000020aa9ff390
rdx=000001d6d48301e4 rsi=000001d6d48301e4 rdi=00000020aa9ff2d0
rip=00007ffa4ef13fdb rsp=00000020aa9fef90 rbp=00000020aa9ff039
r8=000001d98d76eff0 r9=0000000000000002 r10=00000000ffffffef
r11=00000020aa9fef60 r12=00007ffa4ef1fe80 r13=000001d6d4830000
r14=0000000000000001 r15=00000020aa9ff390
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206
libpersona!Emf::EmfLoader::LoadDocument+0x45e5b:
00007ffa`4ef13fdb 4533f6 xor r14d,r14d
0:032> dd 000001d6d48301e4 ;<----------------------------------------- (1)
000001d6`d48301e4 00000053 00000064 00000000 81a0f300
000001d6`d48301f4 00000085 ffffffff ffffffff 00000001
000001d6`d4830204 3f800000 3f800000 00000064 00000064
000001d6`d4830214 00000018 0000004c 00000000 00000000
000001d6`d4830224 00000000 ffffffff ffffffff 00000000
000001d6`d4830234 6c6c6548 45202c6f 7720464d 20687469
000001d6`d4830244 46474f4c 21544e4f 0000000e 00000014
000001d6`d4830254 00000000 00000000 00000000 00000000
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x45e5e:
00007ffa`4ef13fde e8edd4ffff call libpersona!Emf::EmfLoader::LoadDocument+0x43350 (00007ffa`4ef114d0)
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x45e63:
00007ffa`4ef13fe3 498b07 mov rax,qword ptr [r15] ds:00000020`aa9ff390=00007ffa5d93ada0
0:032> bp 00007FFA4EF14130
0:032> g
Breakpoint 2 hit
libpersona!Emf::EmfLoader::LoadDocument+0x45fb0:
00007ffa`4ef14130 8b4e48 mov ecx,dword ptr [rsi+48h] ds:000001d6`d483022c=ffffffff ;<-------------------------------(2)
0:032> r
rax=000001d98b538e70 rbx=0000000000000000 rcx=000000007ffe0380
rdx=00000000000000d0 rsi=000001d6d48301e4 rdi=000001d98b538e70
rip=00007ffa4ef14130 rsp=00000020aa9fef90 rbp=00000020aa9ff039
r8=0000000000000000 r9=0000000000000190 r10=000001d98b538e70
r11=000001d98b538e70 r12=000001d6d48301fc r13=0000000000000064
r14=0000000000000000 r15=00000020aa9ff390
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
libpersona!Emf::EmfLoader::LoadDocument+0x45fb0:
00007ffa`4ef14130 8b4e48 mov ecx,dword ptr [rsi+48h] ds:000001d6`d483022c=ffffffff
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x45fb3:
00007ffa`4ef14133 4803cb add rcx,rbx
0:032> p
libpersona!Emf::EmfLoader::LoadDocument+0x45fb6:
00007ffa`4ef14136 660f6e3431 movd xmm6,dword ptr [rcx+rsi] ds:000001d7`d48301e3=???????? ;<-------------------------------(3)
The contents of the EMR_EXTTEXTOUTA record are examined at (1). At (2), the offDx value is read and used as an offset to access the intercharacter spacing array at (3). Because the offDx value is greater than recordSize in this case, an out‑of‑bounds read occurs. The crash details are as follows:
0:032> g
(1318.1270): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
libpersona!Emf::EmfLoader::LoadDocument+0x45fb6:
00007ffa`4ef14136 660f6e3431 movd xmm6,dword ptr [rcx+rsi] ds:000001d7`d48301e3=????????
0:032> dd 000001d7`d48301e3
000001d7`d48301e3 ???????? ???????? ???????? ????????
000001d7`d48301f3 ???????? ???????? ???????? ????????
000001d7`d4830203 ???????? ???????? ???????? ????????
000001d7`d4830213 ???????? ???????? ???????? ????????
000001d7`d4830223 ???????? ???????? ???????? ????????
000001d7`d4830233 ???????? ???????? ???????? ????????
000001d7`d4830243 ???????? ???????? ???????? ????????
000001d7`d4830253 ???????? ???????? ???????? ????????
0:032> u
libpersona!Emf::EmfLoader::LoadDocument+0x45fb6:
00007ffa`4ef14136 660f6e3431 movd xmm6,dword ptr [rcx+rsi]
00007ffa`4ef1413b f30fe6f6 cvtdq2pd xmm6,xmm6
00007ffa`4ef1413f 0f57c0 xorps xmm0,xmm0
00007ffa`4ef14142 0f1145b7 movups xmmword ptr [rbp-49h],xmm0
00007ffa`4ef14146 488d55b7 lea rdx,[rbp-49h]
00007ffa`4ef1414a 498bcf mov rcx,r15
00007ffa`4ef1414d e82ea2ffff call libpersona!Emf::EmfLoader::LoadDocument+0x40200 (00007ffa`4ef0e380)
00007ffa`4ef14152 f20f117597 movsd mmword ptr [rbp-69h],xmm6
0:032> kb
# RetAddr : Args to Child : Call Site
00 00007ffa`4ef20dbf : 000001d6`d48301d8 000001d9`a6d80f80 000001d6`d48301e4 00000000`00000010 : libpersona!Emf::EmfLoader::LoadDocument+0x45fb6
01 00007ffa`4ef1fe9c : 00000020`aa9ff390 00000000`000001e4 00000000`0000000f 000021d8`00000004 : libpersona!Emf::EmfLoader::LoadDocument+0x52c3f
02 00007ffa`faf0e73f : 00000000`000001e4 000001d9`ab112d20 000001d6`af810000 000001d6`af810000 : libpersona!Emf::EmfLoader::LoadDocument+0x51d1c
03 00007ffa`fc56d432 : 000001d9`afd26fd0 00000020`00000000 000001d9`afd26fd0 00000000`00000000 : gdi32full!bInternalPlayEMF+0x250bf
04 00007ffa`4ef215ce : 00000000`00000000 00000020`aa9ff3f0 00000020`aa9ff670 000001d9`b7cccf90 : GDI32!EnumEnhMetaFileStub+0x52
05 00007ffa`4eecdb56 : 00000020`aa9ff390 00000020`aa9ff320 00000000`00000000 00007ffa`fd881910 : libpersona!Emf::EmfLoader::LoadDocument+0x5344e
06 00007ffa`4eece041 : 000001d9`b7cccf90 000001d9`ab112d20 000001d9`b7cccf90 00000020`aa9ff670 : libpersona!Emf::EmfLoader::LoadDocument+0x86
07 00007ffa`4eece2ab : 00000020`aa9ff708 000001d9`b7cccf90 00000020`aa9ff670 00000020`aa9ff720 : libpersona!Emf::EmfLoader::LoadDocument+0x101
08 00007ffa`4eece124 : 000001d9`c0320740 00000020`aa9ff708 00000020`aa9ff6d8 00000020`aa9ff751 : libpersona!Emf::EmfLoader::LoadDocument+0x12b
09 00007ffa`4ec83a94 : 000001d9`7ed2afb0 000001d9`c0320740 00000020`aa9ff7b0 00000020`aa9ffa78 : libpersona!Emf::EmfLoader::LoadDocument+0x94
0a 00007ffa`4ec5088f : 000001d9`c0320740 00000000`00000000 00000000`00000000 00000000`ffffff00 : libpersona!DocumentController::TryLoadEMF+0xc4
0b 00007ffa`4ec4eacc : 00000000`00000000 000001d9`00000001 00000000`00000000 00000000`00000000 : libpersona!DocumentController::LoadDocumentI+0xfaf
0c 00007ffa`51283602 : 000001d9`8cdf6690 00000000`00000000 000001d9`9a4fcf70 00000000`00000000 : libpersona!DocumentController::LoadDocument+0x8c
0d 00007ffa`52a96cea : 000001d9`8cdf66c8 000001d9`4a70af00 00007ffa`af8c2800 00000000`00000000 : libpersona!LoadDocumentCommand::Do+0x252
0e 00007ffa`af2464cf : 00000000`00000000 000001d9`9a4fcf70 00000000`00000000 000001d9`c46ecfe0 : libpersona!PersonaController::StaticDoCommand+0x3a
0f 00007ffa`af49f47f : 000001d9`b9778fd0 00000000`00000481 00000000`00000000 000001d9`a8c3ef90 : libkernel!Kernel::InSerialiserPropertyDataStream::LoadValues+0xb787f
10 00007ffa`fcc17374 : 00007ffa`af8c2800 00000000`00000000 00000000`00000000 00000000`00000000 : libkernel!Kernel::InSerialiserPropertyDataStream::LoadValues+0x31082f
11 00007ffa`fd87cc91 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : KERNEL32!BaseThreadInitThunk+0x14
12 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x21
0:032> lmDvm libpersona
Browse full module list
start end module name
00007ffa`49180000 00007ffa`60abb000 libpersona (export symbols) C:\Program Files\WindowsApps\Canva.Affinity_3.0.1.3808_x64__8a0j1tnjnt4a4\App\libpersona.dll
Loaded symbol image file: C:\Program Files\WindowsApps\Canva.Affinity_3.0.1.3808_x64__8a0j1tnjnt4a4\App\libpersona.dll
Image path: C:\Program Files\WindowsApps\Canva.Affinity_3.0.1.3808_x64__8a0j1tnjnt4a4\App\libpersona.dll
Image name: libpersona.dll
Browse all global symbols functions data Symbol Reload
Timestamp: Mon Nov 3 07:34:40 2025 (6908CB90)
CheckSum: 17822078
ImageSize: 1793B000
Mapping Form: Loaded
Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4
Information from resource tables:
Exploiting this vulnerability allows for the reading of arbitrary memory within the process, potentially disclosing sensitive information.
See security bulletin on trust.canva.com with the vulnerability details and vulnerable versions. (URL to advisory: https://trust.canva.com/?tcuUid=1f728b0d-17f3-4c9c-97e9-6662b769eb62)
2026-01-27 - Vendor Disclosure
2026-03-17 - Vendor Patch Release
2026-03-17 - Public Release
Discovered by KPC of Cisco Talos.