CVE-2025-64776: 
Homebrew vulnerability analysis and mitigation

CVE-2025-64776 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) parsing functionality of Canva Affinity, specifically within the EMR_BITBLT record handler in libpersona.dll. A specially crafted EMF file with an oversized offBmiSrc field can trigger a read beyond allocated memory boundaries, potentially disclosing sensitive process memory. The vulnerability affects Canva Affinity versions prior to 3.1.0 on Windows (confirmed vulnerable version: 3.0.1.3808). It was disclosed to the vendor on January 27, 2026, patched and publicly released on March 17, 2026. The CVSS v3.1 base score is 6.1 (Medium) per Cisco Talos, with some sources reporting 7.1 (Talos Report, Canva Advisory).

The root cause is classified as CWE-125 (Out-of-bounds Read). Within the EMR_BITBLT record structure, the offBmiSrc field (at offset 0x54) specifies the offset from the start of the record to the source bitmap header. The vulnerable code in libpersona!Emf::EmfLoader::LoadDocument reads offBmiSrc and adds it directly to the base record pointer without validating that the resulting address falls within the bounds of the record's allocated buffer. When offBmiSrc is set to an arbitrarily large value (e.g., 0x00010000) exceeding recordSize, the computed pointer references unallocated memory, and a subsequent read in libbmp!Bmp::FileInputStream::IsValid triggers an access violation (c0000005). Exploitation requires user interaction — a victim must open a malicious .emf file using an affected Affinity application on Windows (Talos Report).

Successful exploitation can result in the disclosure of sensitive data from the Affinity application's process memory and an application crash (denial of service). The confidentiality impact is rated High, as arbitrary process memory can be read; availability impact is also present due to the crash condition, while integrity is unaffected. The attack is local and requires user interaction (social engineering a user to open a malicious EMF file), limiting the scope to the affected workstation without direct lateral movement potential (Talos Report, Canva Advisory).

No confirmed in-the-wild exploitation has been observed, and no weaponized exploit code or proof-of-concept is publicly available. The Cisco Talos advisory provides technical analysis and debugger traces but does not include a ready-to-use exploit payload. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Talos Report).

1. Craft a malicious EMF file: Create an EMF file containing a valid EMR_HEADER record followed by an EMR_BITBLT record (recordType 0x0000004C). Set the offBmiSrc field (at offset 0x54 within the record) to a value larger than the recordSize field — for example, 0x00010000 — so that the computed bitmap header address falls outside the allocated record buffer.
2. Deliver the file to the target: Use social engineering techniques (e.g., phishing email, malicious download link, or shared document) to deliver the crafted .emf file to a user running a vulnerable version of Canva Affinity (prior to 3.1.0) on Windows.
3. Trigger file parsing: Convince the victim to open the malicious EMF file with an Affinity application (Designer, Photo, or Publisher). The application invokes libpersona!Emf::EmfLoader::LoadDocument, which processes the EMR_BITBLT record.
4. Out-of-bounds read occurs: The unvalidated offBmiSrc value is added to the record base pointer, producing an address in unallocated memory. The subsequent call to libpersona!Dib::RasterHelper::CreateBitmapFromDib and then libbmp!Bmp::FileInputStream::IsValid attempts to read from this invalid address.
5. Achieve memory disclosure or crash: The access violation (c0000005) is triggered, potentially exposing process memory contents to an attacker who can observe the crash output, or causing the application to crash (denial of service) (Talos Report).

• Process: Unexpected crash or access violation (c0000005) in Canva Affinity processes (e.g., AffinityDesigner.exe, AffinityPhoto.exe, AffinityPublisher.exe) originating from libpersona.dll or libbmp.dll.
• File System: Presence of unexpected or unsolicited .emf files in user download directories, temporary folders, or email attachment staging areas.
• Logs: Windows Error Reporting (WER) crash dumps referencing libpersona!Emf::EmfLoader::LoadDocument or libbmp!Bmp::FileInputStream::IsValid with access violation exception code 0xc0000005; Event Log entries for application crashes in Affinity suite executables.
• Network: Inbound delivery of .emf files via email or web download from untrusted or unknown sources, particularly if the file is unusually small or structurally anomalous (Talos Report).

Canva released a patch in Affinity version 3.1.0, which addresses this vulnerability. Users should update all Affinity suite applications (Designer, Photo, Publisher) to version 3.1.0 or later via the Microsoft Store or the Affinity website. As a temporary workaround, users should avoid opening EMF files from untrusted or unknown sources, and organizations may consider restricting or disabling EMF file import functionality if it is not required for business operations (Canva Advisory, Talos Report).

The vulnerability was discovered by researcher KPC of Cisco Talos and reported through coordinated disclosure. Cisco Talos published a detailed technical advisory (TALOS-2025-2311) on March 17, 2026, alongside a Talos blog post covering multiple vendor vulnerabilities including this one. Canva published a security bulletin on their trust portal in response. No significant broader community or social media discussion has been identified beyond standard vulnerability database aggregation (Talos Report, Talos Blog).