CVE-2025-65119: 
Homebrew vulnerability analysis and mitigation

CVE-2025-65119 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) file parsing functionality of Canva Affinity, specifically triggered by a malformed EMR_POLYGON record with an inflated Count field. Discovered by KPC of Cisco Talos and disclosed to the vendor on January 27, 2026, the vulnerability was patched and publicly disclosed on March 17, 2026. The confirmed vulnerable version is Canva Affinity 3.0.1.3808 on Windows; versions prior to 3.1.0 are affected. It carries a CVSS v3.1 base score of 6.1 (Medium) (Talos TALOS-2025-2320, Canva Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in the libpersona.dll library within Canva Affinity's EMF loader (Emf::EmfLoader::LoadDocument). When processing an EMR_POLYGON record (recordType 0x00000003), the parser reads the Count field (offset 0x18) to determine the number of PointL objects in the aPoints array (offset 0x1C, each 8 bytes). If an attacker crafts an EMF file where 0x1C + (8 * Count) exceeds the record's recordSize, the parser iterates beyond the allocated buffer, causing an out-of-bounds read. The crash manifests as an access violation (c0000005) in the movd xmm6, dword ptr [r12+4] instruction when the loop pointer advances past the page boundary. Exploitation requires user interaction — the victim must open a specially crafted EMF file — but no privileges are required (Talos TALOS-2025-2320).

Successful exploitation allows an attacker to read arbitrary memory contents within the Canva Affinity process, potentially disclosing sensitive information such as credentials, document contents, or other in-memory data. The vulnerability also causes an application crash (denial of service), as the out-of-bounds read triggers an access violation. There is no integrity impact, and the scope is limited to the local process; lateral movement is not directly facilitated by this vulnerability alone (Talos TALOS-2025-2320).

No confirmed in-the-wild exploitation has been observed, and no weaponized exploit code is publicly available. The Cisco Talos report (TALOS-2025-2320) provides technical analysis and debugger output but does not include a crafted payload or step-by-step exploitation guide. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Talos TALOS-2025-2320).

1. Craft a malicious EMF file: Create an EMF file containing an EMR_POLYGON record (recordType 0x00000003) where the Count field (at offset 0x18) is set to a value large enough that 0x1C + (8 * Count) exceeds the record's recordSize field, causing the aPoints array to extend beyond the allocated buffer.
2. Deliver the file to the target: Use social engineering (e.g., email attachment, shared document link, or malicious download) to convince a user running Canva Affinity 3.0.1.3808 or earlier on Windows to open the crafted EMF file.
3. Trigger file parsing: When the victim opens the file in any Canva Affinity application (Designer, Photo, Publisher), the libpersona.dll EMF loader invokes Emf::EmfLoader::LoadDocument, which processes the malformed EMR_POLYGON record.
4. Out-of-bounds read occurs: The parser verifies Count is non-zero, computes the aPoints base address, then iterates Count times reading 8-byte PointL objects — reading past the end of the allocated buffer into adjacent memory.
5. Achieve objective: Depending on memory layout, the attacker may be able to infer sensitive in-memory data from the application's behavior or crash dump, or simply cause a denial of service via the resulting access violation (Talos TALOS-2025-2320).

• File System: Unexpected or unsolicited .emf files delivered via email, downloads, or shared storage, particularly those with anomalously small recordSize values relative to their Count field in EMR_POLYGON records.
• Process: Canva Affinity application (Designer, Photo, or Publisher) crashing unexpectedly with an access violation (c0000005) shortly after opening an EMF file; crash dumps referencing libpersona!Emf::EmfLoader::LoadDocument in the call stack.
• Logs: Windows Event Log entries (Application log) showing application crash events for Canva Affinity processes coinciding with EMF file open operations; Windows Error Reporting (WER) crash reports for libpersona.dll at offset +0x4b1b5.
• Network: Unusual inbound delivery of .emf files via email or web downloads from untrusted or unknown sources to workstations running Canva Affinity (Talos TALOS-2025-2320).

Canva released a patched version of Affinity (3.1.0) on March 17, 2026; users should update to version 3.1.0 or later immediately. As a workaround, users should avoid opening EMF files from untrusted or unknown sources, and organizations may consider restricting the ability to open EMF files if not required for business operations. No additional configuration-based mitigations have been published by the vendor (Canva Advisory, Talos TALOS-2025-2320).

Cisco Talos published the formal vulnerability report (TALOS-2025-2320) alongside a blog post covering multiple vendor vulnerabilities including this one, providing technical details and debugger output. Canva issued a security bulletin on their trust portal acknowledging the vulnerability and confirming the patch in version 3.1.0. No significant broader community or social media discussion has been observed beyond standard vulnerability database aggregation (Talos Blog, Canva Advisory).