CVE-2025-62403: 
Homebrew vulnerability analysis and mitigation

CVE-2025-62403 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) parsing functionality of Canva Affinity, specifically triggered by a malformed EMR_EXTTEXTOUTA record with an oversized offDx field. It affects Canva Affinity versions prior to 3.1.0 on Windows, with version 3.0.1.3808 confirmed vulnerable. The vulnerability was disclosed to the vendor on January 27, 2026, and both the patch and public disclosure occurred on March 17, 2026. It carries a CVSSv3.1 base score of 6.1 (Medium) per Cisco Talos, though NVD scores it at 7.1 (High) (Talos Report, Canva Advisory).

The root cause is an insufficient bounds check (CWE-125: Out-of-bounds Read) in libpersona.dll within the Emf::EmfLoader::LoadDocument function. When processing an EMR_EXTTEXTOUTA record, the parser reads the offDx field (offset to the intercharacter spacing array) without verifying that offDx + (Chars * 4) does not exceed the record's recordSize. If this condition is violated, the parser accesses memory beyond the allocated record buffer when reading the DxBuffer. Exploitation requires a local attacker to craft a malicious EMF file and have a victim open it in Canva Affinity — no authentication or elevated privileges are required, but user interaction is necessary (Talos Report).

Successful exploitation can result in the disclosure of sensitive information from the Affinity application's process memory, as the out-of-bounds read allows arbitrary memory within the process to be read. Additionally, the access violation can cause the application to crash, resulting in a denial of service for the affected user. Integrity is not impacted, and the scope is limited to the local process — lateral movement or privilege escalation are not directly enabled by this vulnerability (Talos Report, Canva Advisory).

No confirmed public exploit or proof-of-concept code is available; the Cisco Talos advisory provides technical analysis and debugger output but no actionable exploit steps or crafted file payloads. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), reflecting a very low probability of exploitation in the near term (Talos Report).

1. Craft a malicious EMF file: Create an EMF file containing an EMR_EXTTEXTOUTA record (recordType 0x00000053) where the offDx field is set to a value such that offDx + (Chars * 4) exceeds the record's recordSize, causing the parser to read beyond the allocated buffer.
2. Deliver the file to the target: Use social engineering, phishing, or a shared file system to deliver the crafted .emf file to a user running a vulnerable version of Canva Affinity (prior to 3.1.0) on Windows.
3. Trigger file opening: Induce the victim to open the malicious EMF file in Canva Affinity (e.g., via double-click or file import). The application's DocumentController::LoadDocument → TryLoadEMF → Emf::EmfLoader::LoadDocument call chain processes the file.
4. Out-of-bounds read occurs: The parser reads the offDx value and uses it as an offset to access the intercharacter spacing array (DxBuffer) without bounds validation, triggering an out-of-bounds memory read in libpersona.dll.
5. Achieve objective: Depending on memory layout, the attacker may obtain sensitive data from the process's memory space, or cause an application crash (access violation c0000005) (Talos Report).

• File System: Presence of unexpected or unsolicited .emf files in user download directories, temp folders, or email attachments; EMF files with anomalously small recordSize values relative to offDx + (Chars * 4) in the EMR_EXTTEXTOUTA record.
• Process: Canva Affinity process (Affinity.exe or related) terminating unexpectedly with an access violation (c0000005) shortly after opening an EMF file; crash dumps referencing libpersona.dll at offset +0x45fb6 (Emf::EmfLoader::LoadDocument).
• Logs: Windows Event Log entries (Application log) showing application crashes for Canva Affinity with faulting module libpersona.dll; Windows Error Reporting (WER) crash reports for Affinity processes triggered by EMF file parsing.

Canva released a patch in Affinity version 3.1.0, which resolves this vulnerability; users should update immediately (Canva Advisory). As a workaround prior to patching, users should avoid opening EMF files from untrusted or unknown sources, and administrators can restrict EMF file handling through file association policies or endpoint controls. Given the low EPSS score and absence of active exploitation, standard patch management timelines are appropriate, though prompt updating remains the recommended action.

Cisco Talos researcher KPC discovered and reported the vulnerability, with Talos publishing a detailed technical advisory including debugger traces on the public release date of March 17, 2026 (Talos Report). The vulnerability was also covered in a Talos blog post grouping it with other vendor disclosures (TP-Link, Canva, Hikvision), and was picked up by security news aggregators including malware.news. No significant broader community controversy or social media discussion has been observed beyond standard vulnerability tracking.