CVE-2025-66342: 
Homebrew vulnerability analysis and mitigation

CVE-2025-66342 is a type confusion vulnerability (CWE-843) in the EMF (Enhanced Metafile Format) file handling functionality of Canva Affinity for Windows. A specially crafted EMF file can trigger memory corruption, potentially resulting in arbitrary code execution. The vulnerability was discovered by KPC of Cisco Talos, disclosed to the vendor on January 27, 2026, patched and publicly released on March 17, 2026. It affects Canva Affinity versions prior to 3.1.0 on Windows (confirmed vulnerable version: 3.0.1.3808) and carries a CVSS v3.1 base score of 7.8 (High) (Talos Report, Canva Advisory).

The vulnerability resides in libpersona.dll within the Emf::EmfLoader::LoadDocument function, which processes EMF records. Specifically, the flaw occurs when the ihBrush field in an EMR_FRAMERGN record (record type 0x00000048) references a different index than the one used in the corresponding EMR_CREATEBRUSHINDIRECT record (record type 0x00000027). For example, if EMR_CREATEBRUSHINDIRECT stores a brush object at index 0x01, but EMR_FRAMERGN specifies ihBrush = 0x33, the application retrieves an arbitrary, unvalidated object from the EMF object table at that index and treats it as a brush object without type checking. This causes the field at offset 0x18 of the misidentified object — which is uninitialized — to be used as a pointer, triggering an access violation (c0000005) and memory corruption. Depending on memory layout, this could be leveraged for arbitrary read/write and ultimately code execution (Talos Report).

Successful exploitation allows an unauthenticated local attacker to achieve arbitrary code execution with the privileges of the Canva Affinity application process. The vulnerability has high confidentiality, integrity, and availability impact, meaning an attacker could read sensitive data, modify files, or crash the application. User interaction is required — the victim must open a maliciously crafted EMF file — limiting the attack surface to social engineering scenarios, but the consequences upon successful exploitation are severe (Talos Report).

A proof-of-concept exploit with concrete technical details — including specific hex values for crafting a malicious EMF file — is publicly available in the Cisco Talos vulnerability report (TALOS-2025-2297). No in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), indicating a low current probability of exploitation in the wild. No threat actor attribution has been identified (Talos Report).

1. Craft a malicious EMF file: Construct an EMF file containing an EMR_CREATEBRUSHINDIRECT record (type 0x00000027) that registers a brush object at index 0x01 (bytes: 27 00 00 00 18 00 00 00 01 00 00 00 ...), followed by an EMR_FRAMERGN record (type 0x00000048) with the ihBrush field set to a mismatched index such as 0x33 (bytes: 48 00 00 00 58 00 00 00 ... 33 00 00 00 ...).
2. Deliver the file to the target: Use social engineering (e.g., phishing email, malicious download link, or shared network folder) to deliver the crafted .emf file to a user running a vulnerable version of Canva Affinity (< 3.1.0) on Windows.
3. Trigger file opening: Convince the victim to open the malicious EMF file in any Canva Affinity application (Designer, Photo, Publisher), which invokes libpersona!DocumentController::TryLoadEMF and subsequently Emf::EmfLoader::LoadDocument.
4. Trigger type confusion: The EMF loader uses ihBrush = 0x33 as an index into the EMF object table, retrieving an arbitrary object instead of the registered brush. This object is passed to brush-handling code without type validation.
5. Achieve memory corruption: The uninitialized field at offset 0x18 of the misidentified object is dereferenced as a pointer, causing an access violation. With a controlled memory layout, an attacker can manipulate this to gain arbitrary read/write primitives.
6. Execute arbitrary code: Leverage the memory corruption to redirect execution flow, potentially deploying a payload (e.g., reverse shell, dropper) running with the privileges of the Affinity process (Talos Report).

• File System: Presence of unexpected or unsolicited .emf files in user download directories, temp folders (%TEMP%), or email attachment staging areas; EMF files with anomalous structure where ihBrush in EMR_FRAMERGN records does not match any registered brush index.
• Process: Canva Affinity application process (AffinityDesigner.exe, AffinityPhoto.exe, AffinityPublisher.exe) spawning unexpected child processes (e.g., cmd.exe, powershell.exe, curl.exe) or crashing with access violation (c0000005) in libpersona.dll.
• Logs: Windows Event Log entries showing application crashes in libpersona.dll at Emf::EmfLoader::LoadDocument; Windows Error Reporting (WER) crash dumps referencing libpersona!Emf::EmfLoader::LoadDocument+0x4ee74.
• Network: Unexpected outbound network connections from Canva Affinity processes to external IP addresses shortly after opening an EMF file (Talos Report).

Canva has released a patch in Affinity version 3.1.0, which resolves this vulnerability. Users should update all Affinity suite applications (Designer, Photo, Publisher) to version 3.1.0 or later immediately. As a temporary workaround until patching is possible, avoid opening EMF files from untrusted or unknown sources, and consider disabling EMF file type associations or restricting EMF file handling if not required for business operations (Canva Advisory, Talos Report).

Cisco Talos published a detailed technical advisory (TALOS-2025-2297) on March 17, 2026, crediting researcher KPC for the discovery. Canva issued a security bulletin on trust.canva.com acknowledging the vulnerability and confirming the patch in version 3.1.0. The vulnerability received coverage in security community feeds and aggregators, with social media posts on Bluesky and security news outlets noting the Talos disclosure alongside other vulnerabilities in TP-Link and Hikvision products (Talos Blog, Talos Report).