CVE-2025-62500: 
Homebrew vulnerability analysis and mitigation

CVE-2025-62500 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) file processing functionality of Canva Affinity for Windows. Discovered by KPC of Cisco Talos and disclosed on March 17, 2026 (vendor notified January 27, 2026), the vulnerability affects Canva Affinity version 3.0.1.3808 and all versions prior to 3.1.0 on Windows. It carries a CVSSv3.1 base score of 6.1 (Medium) per the Talos advisory, though some sources report 7.1 (High) (Talos Advisory, Canva Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in the Emf::EmfLoader::LoadDocument function within libpersona.dll. The root cause is the failure to validate the nDescription field in the EMF file's EMR_HEADER record: if offDescription + nDescription exceeds the recordSize, the application proceeds to use the oversized nDescription value to calculate the byte count for a memcpy operation, reading memory beyond the bounds of the allocated header buffer. Specifically, nDescription (at offset 0x3C) is used without bounds checking to allocate a destination buffer and then copy the EmfDescription Unicode string, triggering an access violation (c0000005) in VCRUNTIME140!memcpy when the read extends past the end of the mapped EMF data. Exploitation requires user interaction — a victim must open a specially crafted .emf file with an affected Affinity application (Talos Advisory).

Successful exploitation allows an attacker to read arbitrary memory within the Canva Affinity process, potentially disclosing sensitive in-memory information such as document content, credentials, or other data loaded by the application. Additionally, the out-of-bounds read can cause the application to crash, resulting in a denial-of-service condition for the affected user. The vulnerability has no integrity impact and is limited to the local scope of the affected process, with no evidence of lateral movement potential (Talos Advisory, Canva Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been confirmed for CVE-2025-62500. The Cisco Talos report (TALOS-2025-2298) provides technical analysis and debugger traces but does not include a weaponized exploit or crafted EMF file payload. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Talos Advisory).

1. Craft a malicious EMF file: Create an EMF file with a valid EMR_HEADER structure (recordType 0x00000001, recordSignature 0x464D4520) but set the nDescription field (at offset 0x3C) to a value such that offDescription + nDescription significantly exceeds the recordSize field (e.g., set nDescription to 0x29000000 while recordSize is 0xC0).
2. Deliver the file to the target: Use social engineering, phishing, or a malicious download to deliver the crafted .emf file to a system running a vulnerable version of Canva Affinity (prior to 3.1.0 on Windows).
3. Trigger file opening: Convince the victim to open the crafted EMF file using any Affinity application (Designer, Photo, Publisher), which invokes libpersona!DocumentController::TryLoadEMF → Emf::EmfLoader::LoadDocument.
4. Out-of-bounds read occurs: The application reads nDescription without validation, allocates a destination buffer sized by the inflated value, and calls memcpy using the oversized byte count, reading memory beyond the EMR_HEADER buffer boundary.
5. Achieve objective: Depending on memory layout, the attacker may obtain sensitive in-memory data (information disclosure) or cause an application crash (denial of service) via the resulting access violation (Talos Advisory).

• File System: Unexpected or unsolicited .emf files delivered via email attachments, downloads, or shared drives; EMF files with anomalously small recordSize values relative to nDescription + offDescription in the EMR_HEADER.
• Process: Canva Affinity application (Designer, Photo, or Publisher) crashing unexpectedly with an access violation (c0000005) in VCRUNTIME140!memcpy; crash dumps referencing libpersona!Emf::EmfLoader::LoadDocument in the call stack.
• Logs: Windows Error Reporting (WER) crash reports for Canva Affinity processes referencing libpersona.dll and VCRUNTIME140.dll; Event Viewer Application log entries showing faulting module libpersona.dll at the time of EMF file processing.

Canva has released a patch in Affinity version 3.1.0, which addresses this vulnerability. Users should update all Affinity applications (Designer, Photo, Publisher) to version 3.1.0 or later via the Microsoft Store or the Affinity website. As a workaround, organizations should restrict the processing of EMF files from untrusted sources, implement application whitelisting to control which files can be opened, and consider disabling EMF support if not required for workflows (Canva Advisory, Talos Advisory).

Cisco Talos researcher KPC discovered and reported the vulnerability, with Talos publishing a detailed technical advisory (TALOS-2025-2298) on March 17, 2026, including debugger traces demonstrating the out-of-bounds read. Canva responded promptly, releasing a patch on the same day as public disclosure. The Talos blog also covered this vulnerability alongside other vendor disclosures in a broader roundup post (Talos Blog, Talos Advisory).