CVE-2025-66000: 
Homebrew vulnerability analysis and mitigation

CVE-2025-66000 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) file processing functionality of Canva Affinity, specifically triggered by a malformed EMR_POLYDRAW record with an unvalidated Count field. Discovered by KPC of Cisco Talos and disclosed to the vendor on January 27, 2026, the vulnerability was patched and publicly disclosed on March 17, 2026. It affects Canva Affinity version 3.0.1.3808 on Windows (all versions prior to 3.1.0). The CVSSv3.1 score is 6.1 (Medium) per Talos, and 7.1 (High) per NVD (Talos Report, Canva Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in the libpersona.dll library within Canva Affinity's EMF loader (Emf::EmfLoader::LoadDocument). The root cause is the failure to validate the Count field of an EMR_POLYDRAW record before using it to compute the address of the abTypes array: if (0x1C + (8*n) + n) exceeds the record's recordSize, the computed pointer falls outside the allocated buffer. When the application subsequently reads from this out-of-bounds address, an access violation (code c0000005) occurs. Exploitation requires a user to open a specially crafted .emf file, making user interaction a prerequisite (Talos Report).

Successful exploitation allows an attacker to read arbitrary memory within the Canva Affinity process, potentially disclosing sensitive information such as credentials, document content, or other in-memory data. The vulnerability has high confidentiality impact and high availability impact (application crash), but no integrity impact. Because the attack vector is local and requires user interaction (opening a malicious file), the scope is limited to the affected application process and does not directly enable lateral movement (Talos Report, Canva Advisory).

No confirmed in-the-wild exploitation has been observed, and no weaponized exploit or proof-of-concept code is publicly available. The Cisco Talos report provides technical analysis and debugging traces but does not include actionable exploit steps or crafted payloads. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Talos Report).

1. Craft a malicious EMF file: Create an EMF file containing an EMR_POLYDRAW record (recordType 0x00000038) where the Count field is set to an abnormally large value such that 0x1C + (8 * Count) + Count exceeds the record's recordSize, causing the computed abTypes array pointer to fall outside the allocated buffer.
2. Deliver the file to the target: Use social engineering, phishing, or a malicious download to deliver the crafted .emf file to a user running a vulnerable version of Canva Affinity (≤ 3.0.1.3808 on Windows).
3. Trigger file open: Convince the target user to open the malicious EMF file in Canva Affinity (e.g., via File > Open or drag-and-drop), which invokes DocumentController::LoadDocument → TryLoadEMF → Emf::EmfLoader::LoadDocument.
4. Out-of-bounds read occurs: The unvalidated Count value causes the application to compute an out-of-bounds pointer for the abTypes array. When the application reads from this address, an access violation is triggered, potentially exposing adjacent process memory contents.
5. Harvest disclosed memory: Depending on memory layout, the attacker may be able to read sensitive data from the process memory (e.g., via a controlled crash handler or by observing application behavior with a crafted file that avoids a hard crash) (Talos Report).

• Process: Canva Affinity application crash (access violation, code c0000005) shortly after opening an .emf file; unexpected termination of the Affinity process.
• File System: Presence of unexpected or unsolicited .emf files in user download directories or temporary folders, particularly files with anomalously small recordSize relative to a large Count value in an EMR_POLYDRAW record.
• Logs: Windows Event Log entries showing application crash events for Canva.Affinity or libpersona.dll with exception code 0xc0000005 (access violation); crash dump files generated in %LOCALAPPDATA%\CrashDumps or similar locations referencing libpersona!Emf::EmfLoader::LoadDocument.
• Network: Unusual inbound delivery of .emf files via email attachments or web downloads from untrusted sources to systems running Canva Affinity (Talos Report).

Canva has released a patch in Affinity version 3.1.0, which addresses this vulnerability. Users should update Canva Affinity to version 3.1.0 or later immediately. As a workaround prior to patching, users should avoid opening EMF files from untrusted or unknown sources. Organizations may also consider restricting the file types that can be opened within Affinity environments where possible (Canva Advisory, Talos Report).

Cisco Talos researcher KPC discovered and reported the vulnerability, and Talos published a detailed technical advisory (TALOS-2025-2301) on March 17, 2026, including debugger traces and EMF structure documentation. Canva responded promptly, releasing a patch on the same day as public disclosure. The Talos blog also covered this vulnerability alongside other vendor disclosures in a broader roundup post (Talos Blog, Talos Report).