CVE-2025-64301: 
Homebrew vulnerability analysis and mitigation

CVE-2025-64301 is an out-of-bounds write vulnerability in the EMF (Enhanced Metafile Format) parsing functionality of Canva Affinity on Windows. It affects Canva Affinity versions prior to 3.1.0, with version 3.0.1.3808 confirmed vulnerable. The vulnerability was disclosed to the vendor on January 27, 2026, patched and publicly released on March 17, 2026. It carries a CVSS v3.1 base score of 7.8 (High) (Talos Report, Canva Advisory).

The vulnerability is classified as CWE-787 (Out-of-bounds Write) and resides in the libpersona.dll component within the Emf::EmfLoader::LoadDocument and Dib::RasterHelper::CreateDynamicBitmapFromDib functions. When processing an EMR_CREATEDIBPATTERNBRUSHPT record in a crafted EMF file, the application reads the HeaderSize field from the DIBHeaderInfo structure without validating it against the calculated buffer size (CalculatedHeaderSize = (cbBits + offBits - offBmi) + (1 << BitCount)). If HeaderSize exceeds CalculatedHeaderSize, a memcpy operation copies more bytes than the destination buffer can hold, resulting in an out-of-bounds write to arbitrary memory within the process. Exploitation requires a user to open a specially crafted EMF file, making user interaction a necessary precondition (Talos Report).

Successful exploitation allows an attacker to write to arbitrary memory within the Canva Affinity process, potentially leading to arbitrary code execution with the privileges of the application. This results in high confidentiality, integrity, and availability impact on the affected system. The attack is local in scope and limited to the user's session, but could be leveraged for further post-exploitation activity if combined with other techniques (Talos Report).

No confirmed in-the-wild exploitation has been observed, and no weaponized exploit code is publicly available. The Cisco Talos advisory (TALOS-2025-2310) provides technical analysis including debugging output but no actionable exploit payload or reproduction steps. The EPSS score is approximately 0.013% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability was discovered by KPC of Cisco Talos (Talos Report).

1. Craft a malicious EMF file: Create an EMF file containing a valid EMR_HEADER record followed by a specially crafted EMR_CREATEDIBPATTERNBRUSHPT record (recordType 0x0000005E). Set the DIBHeaderInfo.HeaderSize field to a value significantly larger than the CalculatedHeaderSize derived from the record's cbBits, offBits, and offBmi fields.
2. Deliver the file to the target: Distribute the malicious .emf file to the victim via email attachment, file share, download link, or embedded in a document, relying on social engineering to prompt the user to open it in Canva Affinity.
3. Trigger file parsing: When the victim opens the file in any Canva Affinity application on Windows (version < 3.1.0), libpersona.dll processes the EMF records and calls Dib::RasterHelper::CreateDynamicBitmapFromDib.
4. Trigger out-of-bounds write: The unvalidated HeaderSize value is used as the byte count in a memcpy call, writing beyond the allocated destination buffer into adjacent process memory.
5. Achieve code execution: By carefully controlling the content and layout of the crafted EMF data, an attacker may overwrite critical memory structures (e.g., function pointers, vtables) to redirect execution flow and achieve arbitrary code execution within the Affinity process (Talos Report).

• File System: Presence of unexpected or unsolicited .emf files in user download directories, temp folders, or email attachments; files with anomalously large DIBHeaderInfo.HeaderSize values detectable via EMF file parsers.
• Process: Canva Affinity process (Affinity.exe or related) crashing with access violation (c0000005) in VCRUNTIME140!memcpy or libpersona!Dib::RasterHelper::CreateDynamicBitmapFromDib; unexpected child processes spawned from the Affinity application.
• Logs: Windows Error Reporting (WER) crash dumps referencing libpersona.dll at offsets consistent with Emf::EmfLoader::LoadDocument+0x44d70 or Dib::RasterHelper::CreateDynamicBitmapFromDib+0x1da; application event log entries for Canva Affinity crashes shortly after opening an EMF file (Talos Report).

Update Canva Affinity to version 3.1.0 or later, which contains the vendor-supplied patch. Until patching is possible, users should avoid opening EMF files from untrusted or unknown sources in any Canva Affinity application. The vendor advisory is available at the Canva Trust Center (Canva Advisory).

Cisco Talos publicly disclosed the vulnerability on March 17, 2026, via their standard vulnerability report (TALOS-2025-2310), crediting researcher KPC for the discovery. The Talos blog also covered this vulnerability as part of a broader roundup of TP-Link, Canva, and Hikvision vulnerabilities. Community aggregators such as RedPacket Security and security feeds picked up the advisory shortly after publication, but no significant independent researcher commentary or widespread social media discussion has been observed (Talos Blog, Talos Report).