CVE-2025-58427: 
Homebrew vulnerability analysis and mitigation

CVE-2025-58427 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) file processing functionality of Canva Affinity, specifically triggered by a malformed offDx field in the EMR_EXTTEXTOUTW record. Discovered by KPC of Cisco Talos and disclosed to the vendor on January 27, 2026, the vulnerability was patched and publicly disclosed on March 17, 2026. It affects Canva Affinity versions prior to 3.1.0 on Windows (confirmed vulnerable version: 3.0.1.3808). The CVSS v3.1 base score is 6.1 (Medium) per the Talos advisory, though NVD scores it at 7.1 (High) (Talos Advisory, Canva Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in the libpersona.dll module within Canva Affinity's EMF loader (Emf::EmfLoader::LoadDocument). When processing an EMR_EXTTEXTOUTW record, the application reads the offDx field (at offset 0x48) — which specifies the offset from the start of the record to the intercharacter spacing array — and uses it directly as a memory offset without validating that it falls within the bounds of recordSize. If offDx exceeds recordSize, the subsequent memory access at [rcx+rbx] reads beyond the allocated record buffer, causing an out-of-bounds read. Exploitation requires a user to open a specially crafted EMF file, making user interaction a prerequisite (Talos Advisory).

Successful exploitation can result in the disclosure of sensitive memory contents from within the Canva Affinity process, as arbitrary memory within the process address space may be read. Additionally, the out-of-bounds read can cause application instability or a crash, resulting in a denial of service. There is no integrity impact, and the vulnerability is scoped to the local system — lateral movement or remote exploitation is not directly facilitated (Talos Advisory).

There is no confirmed in-the-wild exploitation of CVE-2025-58427, and no weaponized exploit code is publicly available. The Cisco Talos report provides technical analysis and debugger output but does not include actionable exploit steps or crafted payloads. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Talos Advisory).

1. Craft a malicious EMF file: Create an EMF file containing an EMR_EXTTEXTOUTW record (recordType 0x00000054) where the offDx field (at offset 0x48 within the record) is set to a value greater than the record's recordSize field, causing the intercharacter spacing array pointer to reference memory beyond the record's allocated buffer.
2. Deliver the file to the target: Distribute the crafted .emf file to a target user via email attachment, file share, or embedded in a document, relying on social engineering to prompt the user to open it in Canva Affinity.
3. Trigger file parsing: When the victim opens the malicious EMF file in any Canva Affinity application on Windows, the Emf::EmfLoader::LoadDocument function in libpersona.dll processes the EMR_EXTTEXTOUTW record and reads the oversized offDx value.
4. Out-of-bounds read occurs: The application computes the address of the intercharacter spacing array using the unchecked offDx offset, resulting in a memory read beyond the record buffer — potentially exposing process memory contents or crashing the application (Talos Advisory).

• File System: Presence of unexpected or unsolicited .emf files in user download directories, temp folders, or email attachment staging areas; files with valid EMF headers but anomalous EMR_EXTTEXTOUTW records where offDx > recordSize.
• Process: Canva Affinity application crash events or unexpected termination shortly after opening an EMF file; Windows Error Reporting (WER) crash dumps referencing libpersona.dll at offset Emf::EmfLoader::LoadDocument+0x462e6.
• Logs: Windows Application Event Log entries showing faulting module libpersona.dll with exception code 0xC0000005 (access violation) associated with Canva Affinity processes.

Canva released a patched version of Affinity (3.1.0) on March 17, 2026; users should upgrade to version 3.1.0 or later immediately. As a workaround prior to patching, users should avoid opening EMF files from untrusted or unknown sources, and administrators should consider restricting EMF file handling or implementing file type filtering at email gateways and web proxies. No configuration-based mitigation within the application itself has been documented (Canva Advisory, Talos Advisory).

Cisco Talos published the technical advisory (TALOS-2025-2314) on March 17, 2026, crediting researcher KPC for the discovery. Talos also published a blog post covering this and related vulnerabilities affecting TP-Link and Hikvision products, providing broader context for the disclosure. No significant independent researcher commentary or notable social media discussion has been identified beyond standard vulnerability aggregator coverage (Talos Blog, Talos Advisory).