CVE-2025-66042: 
Homebrew vulnerability analysis and mitigation

CVE-2025-66042 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) file parsing functionality of Canva Affinity, a professional creative suite for graphic design and photo editing. The flaw was discovered by KPC of Cisco Talos, disclosed to the vendor on January 27, 2026, patched on March 17, 2026, and publicly released the same day. It affects Canva Affinity version 3.0.1.3808 (Windows) and all versions prior to 3.1.0. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) per Cisco Talos, though an alternate scoring of 7.1 (High) has also been reported (Talos Advisory, Canva Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in the Emf::EmfLoader::LoadDocument function within libpersona.dll. The root cause is insufficient validation of the CountRects field within the RgnData structure of an EMR_EXTSELECTCLIPRGN EMF record: when (CountRects * 0x10 + 0x20) exceeds the declared RgnDataSize, the application iterates a loop CountRects times over RegionData entries without enforcing the actual buffer boundary, resulting in reads beyond allocated memory. The code only checks that RgnDataSize is non-zero before processing, but does not validate that CountRects is consistent with RgnDataSize, allowing a crafted EMF file with an inflated CountRects value to trigger the out-of-bounds read. Exploitation requires user interaction — specifically, a victim must open a maliciously crafted EMF file using the Affinity application (Talos Advisory).

Successful exploitation allows an attacker to read arbitrary memory within the Canva Affinity process, potentially disclosing sensitive in-memory information such as credentials, document content, or other data loaded by the application. Additionally, the out-of-bounds read can cause an access violation (crash), resulting in denial of service (application termination). There is no integrity impact, and the vulnerability is scoped to the local system with no evidence of lateral movement potential (Talos Advisory, Feedly).

No confirmed public exploit code or proof-of-concept is available for CVE-2025-66042; the Cisco Talos advisory provides technical analysis but no weaponized payload or reproduction steps. There is no evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term (Talos Advisory, Feedly).

1. Craft a malicious EMF file: Create an EMF file containing a valid EMR_HEADER record followed by an EMR_EXTSELECTCLIPRGN record (recordType 0x0000004B). Within the RgnData field, set the CountRects value to an excessively large number such that (CountRects * 0x10 + 0x20) significantly exceeds the declared RgnDataSize.
2. Deliver the file to the target: Use social engineering (e.g., phishing email, malicious download link, or shared file) to deliver the crafted .emf file to a user running a vulnerable version of Canva Affinity (prior to 3.1.0) on Windows.
3. Trigger file parsing: Convince the victim to open the malicious EMF file with Canva Affinity (e.g., Affinity Designer, Photo, or Publisher). The application will invoke libpersona!DocumentController::TryLoadEMF, which calls Emf::EmfLoader::LoadDocument.
4. Out-of-bounds read occurs: The EMF parser reads the inflated CountRects value and iterates a loop that accesses RegionData entries beyond the allocated buffer, reading arbitrary process memory.
5. Achieve objective: The out-of-bounds read may expose sensitive in-memory data (memory disclosure) and will ultimately cause an access violation crash (c0000005), resulting in application denial of service (Talos Advisory).

• File System: Presence of unexpected or unsolicited .emf files in user download directories, email attachments, or shared folders; files with valid EMF headers but anomalously large CountRects values in EMR_EXTSELECTCLIPRGN records.
• Process: Canva Affinity application (e.g., AffinityDesigner.exe, AffinityPhoto.exe, AffinityPublisher.exe) crashing with access violation (c0000005) shortly after opening an EMF file; crash dumps referencing libpersona.dll at offset Emf::EmfLoader::LoadDocument+0x418d8.
• Logs: Windows Event Log entries (Application log) showing application crash events for Canva Affinity processes; Windows Error Reporting (WER) crash reports referencing libpersona.dll as the faulting module.

Canva released a patch in Affinity version 3.1.0 on March 17, 2026; users should update to version 3.1.0 or later immediately. As a temporary workaround prior to patching, users should avoid opening EMF files from untrusted or unknown sources. Organizations may also consider restricting EMF file type associations or blocking EMF files at email gateways and web proxies if the format is not required for business operations (Canva Advisory, Talos Advisory).

Cisco Talos published the detailed technical advisory (TALOS-2025-2319) on March 17, 2026, crediting researcher KPC for the discovery. Canva issued a security bulletin on their trust portal in response to the coordinated disclosure. The Talos blog also covered this vulnerability alongside other vendor disclosures in a broader roundup post (Talos Blog, Talos Advisory). No significant social media discussion or broader community reaction has been observed beyond standard vulnerability tracking aggregators.