CVE-2025-61952: 
Homebrew vulnerability analysis and mitigation

CVE-2025-61952 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) file parsing functionality of Canva Affinity, specifically triggered by a malformed EMR_POLYBEZIER record with an inflated Count field. It affects Canva Affinity version 3.0.1.3808 on Windows (all versions before 3.1.0). The vulnerability was discovered by KPC of Cisco Talos, disclosed to the vendor on January 27, 2026, and publicly released alongside a vendor patch on March 17, 2026. It carries a CVSSv3.1 base score of 6.1 (Medium) per Talos, and 7.1 (High) per NVD (Talos Advisory, Canva Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in the libpersona.dll library within Canva Affinity's EMF loader (Emf::EmfLoader::LoadDocument). The root cause is a missing bounds check: when processing an EMR_POLYBEZIER record, the parser reads the Count (N) field and iterates N times over the aPoints array starting at offset 0x1C, without verifying that 0x1C + (8 * N) stays within the record's declared recordSize. An attacker can craft an EMF file where Count is set to an excessively large value, causing the loop to read PointL objects beyond the allocated buffer boundary, resulting in an access violation (c0000005) in the process (Talos Advisory). Exploitation requires user interaction — the victim must open the malicious EMF file in an affected Affinity application.

Successful exploitation can lead to two primary consequences: disclosure of sensitive information from process memory (confidentiality impact) and application crash (availability impact). The out-of-bounds read allows an attacker to read arbitrary memory within the Affinity process, potentially exposing in-memory data such as document contents, credentials, or other sensitive artifacts. There is no integrity impact, and the scope is limited to the local system running the affected application; lateral movement potential is low (Talos Advisory, Canva Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been confirmed for CVE-2025-61952. The Cisco Talos advisory provides technical analysis and debugger output but no actionable exploit payload. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and user interaction (opening a crafted EMF file), which further limits the attack surface (Talos Advisory).

1. Craft a malicious EMF file: Create an EMF file containing a valid EMR_HEADER record followed by an EMR_POLYBEZIER record (recordType = 0x00000002). Set the Count field at offset 0x18 to an excessively large value such that 0x1C + (8 * Count) significantly exceeds the recordSize field, causing the aPoints array to extend beyond the allocated buffer.
2. Deliver the file to the target: Use social engineering, phishing, or a malicious download to deliver the crafted .emf file to a Windows system running Canva Affinity version 3.0.1.3808 or earlier.
3. Induce the victim to open the file: Convince the user to open the crafted EMF file in any Affinity application (e.g., Affinity Designer, Affinity Photo, Affinity Publisher), which triggers the vulnerable Emf::EmfLoader::LoadDocument code path in libpersona.dll.
4. Trigger out-of-bounds read: The EMF parser reads the inflated Count value, passes the non-zero check, and enters a loop that iterates over aPoints data beyond the record boundary, reading arbitrary process memory.
5. Achieve objective: Depending on the memory layout, the attacker may obtain sensitive in-memory data (memory disclosure) or cause the application to crash with an access violation (c0000005) (Talos Advisory).

• File System: Presence of unexpected or unsolicited .emf files in user download directories, temp folders, or email attachment staging areas; files with valid EMF headers but anomalously large Count values in EMR_POLYBEZIER records.
• Process: Canva Affinity application (e.g., AffinityDesigner.exe, AffinityPhoto.exe, AffinityPublisher.exe) crashing with an access violation (c0000005) shortly after opening an EMF file; crash dumps referencing libpersona.dll at offset +0x48535 in Emf::EmfLoader::LoadDocument.
• Logs: Windows Event Log entries (Application log) showing application crash events for Affinity processes with faulting module libpersona.dll; Windows Error Reporting (WER) crash reports referencing libpersona!Emf::EmfLoader::LoadDocument.

Canva released a patched version of Affinity (3.1.0) on March 17, 2026, which addresses this vulnerability. Users should update all Affinity applications to version 3.1.0 or later immediately. As an interim workaround, avoid opening EMF files from untrusted or unknown sources. No additional configuration-based mitigations have been published (Canva Advisory, Talos Advisory).

Cisco Talos researcher KPC discovered and reported the vulnerability, with Talos publishing a detailed technical advisory (TALOS-2025-2317) on the public release date. Canva acknowledged the issue and published a security bulletin on their trust portal. The Talos blog also covered this vulnerability as part of a broader roundup of TP-Link, Canva, and Hikvision vulnerabilities (Talos Blog). Community reaction has been limited given the medium severity and lack of active exploitation.