CVE-2025-47873: 
Homebrew vulnerability analysis and mitigation

CVE-2025-47873 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) file parsing functionality of Canva Affinity, specifically triggered by a malformed EMR_POLYBEZIER16 record with an inflated Count field. It affects Canva Affinity versions prior to 3.1.0 on Windows, with version 3.0.1.3808 confirmed vulnerable. The vulnerability was disclosed to the vendor on January 27, 2026, patched and publicly released on March 17, 2026. It carries a CVSS v3.1 base score of 6.1 (Medium) per Talos, or 7.1 (High) per NVD scoring (Talos Report, Canva Advisory).

The root cause is CWE-125 (Out-of-bounds Read) in the libpersona.dll component's Emf::EmfLoader::LoadDocument function. When parsing an EMR_POLYBEZIER16 record (record type 0x00000055), the parser reads the Count field at offset 0x18 and iterates over the aPoints array starting at offset 0x1C, reading 4-byte PointS objects. The vulnerability occurs when (0x1C + (4 * Count)) exceeds the record's declared recordSize — the parser does not validate this boundary, allowing the loop to read beyond the allocated buffer. An attacker must craft a malicious EMF file with an oversized Count value and trick a user into opening it in Canva Affinity; no privileges are required, but user interaction is necessary (Talos Report).

Successful exploitation can result in the disclosure of sensitive data from the Canva Affinity process memory and an application crash (denial of service). The out-of-bounds read allows an attacker to access arbitrary memory within the process, potentially exposing in-memory content such as document data, credentials, or other sensitive information loaded by the application. Integrity is not directly impacted, and the attack is confined to the local system running the vulnerable Affinity application (Talos Report, Canva Advisory).

No confirmed in-the-wild exploitation has been observed, and no weaponized exploit code is publicly available. The Cisco Talos advisory (TALOS-2025-2316) provides technical analysis and debugger output but does not include a ready-to-use exploit or crafted payload. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Talos Report).

1. Craft a malicious EMF file: Create an EMF file containing a valid EMR_HEADER record followed by an EMR_POLYBEZIER16 record (type 0x00000055). Set the Count field at offset 0x18 to an excessively large value such that 0x1C + (4 * Count) exceeds the recordSize field, causing the aPoints array to extend beyond the allocated record buffer.
2. Deliver the file to the target: Use social engineering (e.g., phishing email, malicious download link, shared document) to deliver the crafted .emf file to a user running a vulnerable version of Canva Affinity (prior to 3.1.0 on Windows).
3. Trigger file parsing: Convince the target user to open the malicious EMF file in Canva Affinity. The application will invoke libpersona!Emf::EmfLoader::LoadDocument, which processes the EMR_POLYBEZIER16 record.
4. Out-of-bounds read occurs: The parser reads the inflated Count value, obtains the base address of aPoints at offset 0x1C, and iterates the loop without bounds checking, reading PointS objects beyond the record boundary into adjacent process memory.
5. Memory disclosure or crash: The out-of-bounds read either exposes process memory contents (potentially including sensitive in-memory data) or triggers an access violation (c0000005), crashing the application (Talos Report).

• File System: Presence of unexpected or unsolicited .emf files in user download directories, email attachments, or shared folders; files with valid EMF headers but anomalously large Count values in EMR_POLYBEZIER16 records.
• Process/Application: Canva Affinity application crashes (access violation c0000005) when opening EMF files, particularly in libpersona!Emf::EmfLoader::LoadDocument; Windows Error Reporting (WER) crash dumps referencing libpersona.dll at offset +0x48201.
• Logs: Windows Application Event Log entries showing Canva Affinity (process Canva.Affinity) terminating unexpectedly; WER crash reports with faulting module libpersona.dll and exception code 0xc0000005.

Canva has released a patch in Affinity version 3.1.0, which addresses this vulnerability. Users should update Canva Affinity to version 3.1.0 or later immediately via the Microsoft Store or the Affinity website. As an interim workaround until patching is complete, users should avoid opening EMF files from untrusted or unknown sources (Canva Advisory, Talos Report).

The vulnerability was discovered by researcher KPC of Cisco Talos and responsibly disclosed to Canva on January 27, 2026, with coordinated public release on March 17, 2026. Talos published a detailed technical write-up (TALOS-2025-2316) covering the EMF parsing flaw and debugger analysis. Canva published a corresponding security bulletin on their trust portal. Coverage was also noted in the Talos blog post covering multiple vendor vulnerabilities including TP-Link and Hikvision (Talos Report, Talos Blog).