CVE-2025-66503: 
Homebrew vulnerability analysis and mitigation

CVE-2025-66503 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) file parsing functionality of Canva Affinity, specifically in the handling of EMR_POLYBEZIERTO records. Discovered by KPC of Cisco Talos and disclosed to the vendor on January 27, 2026, the vulnerability was patched and publicly disclosed on March 17, 2026. It affects Canva Affinity version 3.0.1.3808 (Windows) and all versions prior to 3.1.0. The CVSSv3.1 base score is 6.1 (Medium) per Cisco Talos, though Feedly's aggregated data also references a score of 7.1 (High) from an alternate vector (Talos Report, Canva Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in libpersona.dll within the Emf::EmfLoader::LoadDocument function. The root cause is a missing bounds check in the processing of EMR_POLYBEZIERTO records: the Count field (at offset 0x18) specifies the number of PointL objects in the aPoints array (starting at offset 0x1C), but the parser does not verify that 0x1C + (8 * Count) is within the record's declared recordSize. When a crafted EMF file supplies an inflated Count value, the loop iterating over aPoints reads beyond the allocated buffer, triggering an access violation (c0000005). Exploitation requires user interaction — a victim must open a specially crafted .emf file in a vulnerable Affinity application on Windows (Talos Report).

Successful exploitation allows an attacker to read arbitrary memory within the Affinity process, potentially disclosing sensitive in-memory information such as document contents, credentials cached in memory, or other process data. Additionally, the out-of-bounds read can cause an application crash (denial of service), as evidenced by the access violation observed during analysis. The vulnerability is scoped to the local system and does not directly enable code execution or lateral movement, but memory disclosure could facilitate further exploitation (Talos Report, Canva Advisory).

No confirmed public exploit or proof-of-concept code is available; the Cisco Talos advisory provides technical analysis and debugger traces but no actionable exploit steps or crafted payload. There is no evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term (Talos Report).

1. Craft a malicious EMF file: Create an EMF file containing an EMR_POLYBEZIERTO record (recordType 0x00000005) where the Count field at offset 0x18 is set to an excessively large value such that 0x1C + (8 * Count) exceeds the record's recordSize field.
2. Deliver the file to the target: Use social engineering (e.g., phishing email, malicious download link, or shared document) to convince a user running a vulnerable version of Canva Affinity (prior to 3.1.0 on Windows) to open the crafted EMF file.
3. Trigger the vulnerability: When the victim opens the file, Affinity's libpersona.dll processes the EMF via Emf::EmfLoader::LoadDocument. The parser verifies Count is non-zero but does not validate it against recordSize, then enters a loop reading PointL objects from aPoints beyond the allocated buffer.
4. Out-of-bounds read occurs: The loop reads memory past the end of the record buffer, potentially exposing adjacent process memory contents. If the read crosses a page boundary, an access violation crash occurs instead.
5. Collect disclosed data: In a controlled exploitation scenario, the attacker would need a mechanism (e.g., a side channel or additional vulnerability) to exfiltrate the read memory contents, as this vulnerability alone does not provide a direct data return path (Talos Report).

• File System: Unexpected or unsolicited .emf files delivered via email attachments, downloads, or shared drives, particularly those with anomalously small recordSize values relative to their Count fields in EMR_POLYBEZIERTO records.
• Logs: Application crash logs or Windows Error Reporting (WER) entries referencing libpersona.dll with access violation code c0000005 at offsets near Emf::EmfLoader::LoadDocument+0x48b90.
• Process: Canva Affinity process (Affinity.exe or related) terminating unexpectedly after opening an EMF file; crash dumps in %LOCALAPPDATA%\CrashDumps or %TEMP% referencing libpersona.dll.
• Network: Unusual inbound delivery of .emf files via email or web traffic to endpoints running Canva Affinity, especially from untrusted or external sources (Talos Report).

Update Canva Affinity to version 3.1.0 or later, which contains the vendor-released patch as of March 17, 2026. Until patching is possible, avoid opening EMF files from untrusted or unknown sources. As an additional precaution, consider restricting file associations or user permissions to prevent automatic opening of .emf files in Affinity applications where business operations allow (Canva Advisory, Talos Report).

Cisco Talos published the detailed technical advisory (TALOS-2025-2318) on March 17, 2026, crediting researcher KPC for the discovery. Canva issued a security bulletin on their trust portal in coordination with the Talos disclosure. The Talos blog also covered this vulnerability alongside other findings in a broader post on TP-Link, Canva, and Hikvision vulnerabilities (Talos Blog, Talos Report). No significant broader community or social media discussion has been identified beyond standard vulnerability aggregator coverage.