CVE-2025-64733: 
Homebrew vulnerability analysis and mitigation

CVE-2025-64733 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) file processing functionality of Canva Affinity, specifically triggered via a malformed EMR_CREATEDIBPATTERNBRUSHPT record. Discovered by KPC of Cisco Talos and disclosed to the vendor on January 27, 2026, with a patch released and public disclosure on March 17, 2026. The confirmed vulnerable version is Canva Affinity 3.0.1.3808 on Windows; versions prior to 3.1.0 are affected. It carries a CVSS v3.1 base score of 6.1 (Medium) per Talos, with some sources reporting 7.1 (High) (Talos Report, Red Hat CVE).

The root cause is CWE-125 (Out-of-bounds Read): the offBmi field in an EMR_CREATEDIBPATTERNBRUSHPT EMF record is used as an offset to locate the DIB header, but its value is never validated against the record's recordSize field. When offBmi is set to an arbitrarily large value, the computed pointer (record_base + offBmi) falls outside the allocated buffer, pointing to an unallocated memory region. The subsequent call to Dib::RasterHelper::CreateDynamicBitmapFromDib then attempts to read from this invalid address, triggering an access violation (c0000005) in libbmp!Bmp::FileInputStream::IsValid. Exploitation requires local access and user interaction — a victim must open a specially crafted EMF file in Canva Affinity on Windows (Talos Report).

Successful exploitation can result in the disclosure of sensitive information from the application's process memory (high confidentiality impact) and an application crash (availability impact). The vulnerability is scoped to the affected process and does not provide write primitives or privilege escalation on its own, so integrity is not directly impacted. The primary risks are memory disclosure — potentially exposing in-memory data such as document contents or credentials cached by the application — and denial of service via crash (Talos Report).

No confirmed in-the-wild exploitation has been observed, and no functional public exploit or proof-of-concept code is available. Cisco Talos assessed all analyzed references as non-exploitable advisories rather than working exploits. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering a user into opening a malicious EMF file (Talos Report).

1. Craft malicious EMF file: Create a valid EMF file containing an EMR_CREATEDIBPATTERNBRUSHPT record (recordType 0x0000005E) where the offBmi field at offset 0x10 is set to a value larger than the record's recordSize, causing the computed DIB header pointer to fall outside the allocated buffer.
2. Deliver the file: Distribute the crafted .emf file to a target user via email attachment, file share, or download link, relying on social engineering to prompt the user to open it in Canva Affinity on Windows.
3. Trigger parsing: When the victim opens the file in Canva Affinity (version < 3.1.0), the libpersona.dll EMF loader (Emf::EmfLoader::LoadDocument) reads the offBmi value and adds it to the record base pointer without bounds validation.
4. Out-of-bounds read occurs: The computed address (record_base + offBmi) points to an unallocated memory region; Dib::RasterHelper::CreateDynamicBitmapFromDib attempts to read from this address, triggering an access violation and potentially exposing adjacent process memory contents.
5. Achieve objective: Depending on memory layout, the attacker may obtain sensitive in-memory data (e.g., document contents) via a side-channel or crash the application, causing denial of service (Talos Report).

• File System: Unexpected or unsolicited .emf files delivered to users, particularly those with anomalously large offBmi values in EMR_CREATEDIBPATTERNBRUSHPT records (recordType 0x0000005E at offset 0x00).
• Process: Canva Affinity process (Affinity.exe or associated app container) crashing with access violation code c0000005 in libbmp.dll or libpersona.dll; crash dumps referencing libbmp!Bmp::FileInputStream::IsValid+0x20a0 or libpersona!Emf::EmfLoader::LoadDocument.
• Logs: Windows Error Reporting (WER) crash reports for Canva.Affinity referencing faulting module libpersona.dll or libbmp.dll; Event Log entries (Application log) showing application crashes correlated with EMF file open operations (Talos Report).

Canva released a patched version of Affinity (3.1.0) on March 17, 2026; users should update to version 3.1.0 or later immediately. As a temporary workaround prior to patching, avoid opening EMF files from untrusted or unknown sources, and consider restricting EMF file handling within the organization if not essential to workflows. The vendor advisory is available via the Canva trust portal (Canva Advisory, Talos Report).

Cisco Talos published the detailed technical advisory (TALOS-2025-2300) on March 17, 2026, crediting researcher KPC for the discovery. The Talos blog also covered this vulnerability alongside other vendor disclosures in a roundup post. No significant independent researcher commentary or broad social media discussion has been identified beyond standard vulnerability database aggregation (Talos Blog, Talos Report).