CVE-2025-61979: 
Homebrew vulnerability analysis and mitigation

CVE-2025-61979 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) file parsing functionality of Canva Affinity, specifically within the EMR_HEADER record processing in libpersona.dll. Discovered by KPC of Cisco Talos and disclosed to the vendor on January 27, 2026, the vulnerability was patched and publicly disclosed on March 17, 2026. It affects Canva Affinity version 3.0.1.3808 (and all versions prior to 3.1.0) on Windows. The CVSS v3.1 base score is 7.1 (High) per NVD, while Talos rates it 6.1 (Medium) (Talos Advisory, Canva Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in the Emf::EmfLoader::LoadDocument function within libpersona.dll. The root cause is a missing validation of the offDescription field in the EMR_HEADER structure of EMF files: when offDescription + nDescription exceeds the recordSize, the parser computes a pointer that falls outside the allocated buffer and passes it to memcpy, triggering an access violation (c0000005) via VCRUNTIME140!memcpy. Exploitation requires no privileges but does require user interaction — a victim must open a specially crafted EMF file. The attack vector is local (the malicious file must be delivered to and opened by the target), with low attack complexity (Talos Advisory).

Successful exploitation allows an attacker to read arbitrary memory within the Canva Affinity process, potentially disclosing sensitive in-memory information such as credentials, document content, or other application data. Additionally, the out-of-bounds read causes an application crash (access violation), resulting in a denial of service for the affected user. There is no integrity impact, and the scope is limited to the affected application process; lateral movement is not directly facilitated by this vulnerability (Talos Advisory, Canva Advisory).

No confirmed in-the-wild exploitation has been observed, and no functional proof-of-concept exploit code is publicly available. Cisco Talos assessed all analyzed references as non-exploitable advisories rather than working exploits. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Talos Advisory).

1. Craft a malicious EMF file: Create an EMF file with a manipulated EMR_HEADER record where the offDescription field is set to a value such that offDescription + nDescription exceeds the recordSize (e.g., set offDescription to 0x1000 while recordSize is 0xC0), causing the parser to compute an out-of-bounds pointer.
2. Deliver the file to the target: Use social engineering (e.g., phishing email, malicious download link, or shared document) to deliver the crafted .emf file to a user running a vulnerable version of Canva Affinity (prior to 3.1.0) on Windows.
3. Trigger file opening: Convince the victim to open the crafted EMF file in Canva Affinity (e.g., by embedding it in a project or sending it as a standalone file).
4. Out-of-bounds read occurs: When Affinity processes the EMR_HEADER, libpersona.dll reads offDescription without bounds checking, computes an invalid pointer, and passes it to memcpy, reading from unallocated memory — potentially exposing in-process memory contents or crashing the application (Talos Advisory).

• File System: Presence of unexpected or unsolicited .emf files in user download directories, email attachments, or shared folders; EMF files with anomalously small recordSize values relative to their offDescription field.
• Process: Canva Affinity application crash (access violation c0000005) originating from VCRUNTIME140!memcpy called via libpersona!Emf::EmfLoader::LoadDocument; Windows Error Reporting (WER) crash dumps referencing libpersona.dll at offset +0x3a4a1.
• Logs: Windows Application Event Log entries showing Canva Affinity (process Canva.Affinity) terminating unexpectedly; WER crash reports in %LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue referencing libpersona.dll faults (Talos Advisory).

Canva released a patched version of Affinity (3.1.0) on March 17, 2026; users should update to version 3.1.0 or later immediately. As a temporary workaround until patching is possible, users should avoid opening EMF files from untrusted or unknown sources. Organizations can also consider blocking EMF file types at email gateways and web proxies to reduce the attack surface (Canva Advisory, Talos Advisory).

Cisco Talos published the detailed technical advisory (TALOS-2025-2299) on March 17, 2026, crediting researcher KPC for the discovery. Canva responded promptly by releasing a patch on the same day as public disclosure and publishing a security bulletin on their trust portal. A Talos blog post covering this and related vulnerabilities (TP-Link, Canva, Hikvision) was published shortly after, drawing moderate community attention on security news aggregators (Talos Advisory, Canva Advisory).