CVE-2025-64735: 
Homebrew vulnerability analysis and mitigation

CVE-2025-64735 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) file processing functionality of Canva Affinity, specifically triggered by a maliciously crafted EMF file containing an oversized offBmiSrc field in an EMR_STRETCHBLT record. The vulnerability was discovered by KPC of Cisco Talos, disclosed to the vendor on January 27, 2026, patched and publicly released on March 17, 2026. It affects Canva Affinity version 3.0.1.3808 on Windows (all versions prior to 3.1.0). The CVSS v3.1 base score is 6.1 (Medium) per the Talos advisory, though an alternate scoring of 7.1 (High) has also been reported (Talos Advisory, Canva Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in the libpersona.dll module within Canva Affinity's EMF loader (Emf::EmfLoader::LoadDocument). When processing an EMR_STRETCHBLT record, the application reads the offBmiSrc field (offset 0x54 in the record) — which specifies the offset from the record's start to the source bitmap header — and adds it directly to the record's base pointer without validating that the resulting address falls within the bounds of the allocated record buffer. If offBmiSrc is set to an arbitrarily large value (e.g., 0x00010000) exceeding recordSize, the computed pointer references unallocated memory, and a subsequent read in libbmp!Bmp::FileInputStream::IsValid triggers an access violation (code c0000005). Exploitation requires a user to open a specially crafted EMF file, making user interaction a necessary precondition (Talos Advisory).

Successful exploitation allows an attacker to read arbitrary memory within the Canva Affinity process, potentially disclosing sensitive in-memory information such as document content, credentials cached in memory, or other application data. Additionally, the out-of-bounds read causes an application crash, resulting in a denial of service for the affected user. There is no integrity impact, and the vulnerability is confined to the local system with no known lateral movement potential (Talos Advisory, Canva Advisory).

No confirmed in-the-wild exploitation has been reported, and no functional exploit code is publicly available. The Cisco Talos report provides technical analysis and debugger traces but does not include a weaponized payload or step-by-step reproduction guide. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Talos Advisory).

1. Craft a malicious EMF file: Create a valid EMF file with a well-formed EMR_HEADER record (recordType 0x00000001, recordSignature 0x464D4520). Include an EMR_STRETCHBLT record (recordType 0x0000004D) with the offBmiSrc field (at offset 0x54 within the record) set to a value significantly larger than the recordSize field (e.g., 0x00010000), so that the computed bitmap header address falls outside the allocated record buffer.
2. Deliver the file to the target: Use social engineering (e.g., phishing email, malicious download link, or shared document) to convince a user running Canva Affinity 3.0.1.3808 on Windows to open the crafted EMF file.
3. Trigger EMF parsing: When the user opens the file, Canva Affinity's libpersona.dll invokes Emf::EmfLoader::LoadDocument, which processes the EMR_STRETCHBLT record and reads the oversized offBmiSrc value without bounds validation.
4. Out-of-bounds read occurs: The application computes an out-of-bounds pointer (base + offBmiSrc) pointing to unallocated memory and passes it to libbmp!Bmp::FileInputStream::IsValid, triggering an access violation and reading arbitrary process memory.
5. Achieve objective: Depending on memory layout, the attacker may obtain sensitive data from the process's memory space (information disclosure) or cause the application to crash (denial of service) (Talos Advisory).

• File System: Presence of unexpected or unsolicited .emf files in user download directories, temporary folders, or email attachment staging areas; files with valid EMF headers but anomalously large offBmiSrc values in EMR_STRETCHBLT records.
• Process: Canva Affinity application crash (access violation, exception code c0000005) shortly after opening an EMF file; Windows Error Reporting (WER) crash dumps referencing libpersona.dll at offset Emf::EmfLoader::LoadDocument+0x4d604 or libbmp!Bmp::FileInputStream::IsValid+0x20a0.
• Logs: Windows Application Event Log entries showing Canva Affinity (process Canva.Affinity) terminating unexpectedly; WER entries in %LOCALAPPDATA%\Microsoft\Windows\WER\ReportArchive referencing libpersona.dll or libbmp.dll faults (Talos Advisory).

Canva released a patched version of Affinity (3.1.0) on March 17, 2026; users should update to version 3.1.0 or later immediately. As a temporary workaround prior to patching, users should avoid opening EMF files from untrusted or unknown sources, and administrators may consider disabling EMF file handling within Affinity if the format is not required for business operations. No configuration-based mitigation within the vulnerable version has been documented (Canva Advisory, Talos Advisory).

Cisco Talos published a detailed technical advisory (TALOS-2025-2312) on March 17, 2026, authored by researcher KPC, providing debugger traces and structural analysis of the vulnerability. Canva responded promptly by releasing a patch on the same day as public disclosure and publishing a security bulletin on their trust portal. The Talos blog also covered this vulnerability as part of a broader roundup of TP-Link, Canva, and Hikvision vulnerabilities, which received coverage on security news aggregators such as Malware.news (Talos Advisory, Talos Blog).