CVE-2025-66617: 
Homebrew vulnerability analysis and mitigation

CVE-2025-66617 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) file parsing functionality of Canva Affinity, specifically triggered by a malformed EMR_POLYPOLYLINE16 record. It affects Canva Affinity versions prior to 3.1.0 on Windows (confirmed vulnerable version: 3.0.1.3808). The vulnerability was disclosed to the vendor on January 27, 2026, patched and publicly released on March 17, 2026. It carries a CVSSv3.1 score of 6.1 (Medium) per Talos, with an alternate score of 7.1 (High) reported by other sources (Talos Advisory, Canva Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in the libpersona.dll module within Canva Affinity's EMF loader (Emf::EmfLoader::LoadDocument). The root cause is insufficient validation of the Count field in the EMR_POLYPOLYLINE16 record: when the computed offset (0x20 + (4 * NumberOfPolylines) + (4 * Count)) exceeds the record's declared recordSize, the parser continues iterating over the aPoints array beyond the allocated buffer boundary. Exploitation requires a local attacker to deliver a specially crafted EMF file to a user who then opens it in Affinity — no privileges are required, but user interaction is necessary. Cisco Talos researcher KPC discovered the vulnerability and published detailed debug traces showing the access violation at libpersona!Emf::EmfLoader::LoadDocument+0x49f10 (Talos Advisory).

Successful exploitation allows an attacker to read arbitrary memory within the Canva Affinity process, potentially disclosing sensitive in-memory data such as document contents, credentials, or other application state. Additionally, the out-of-bounds read can cause an application crash (access violation c0000005), resulting in a denial of service for the affected user. The vulnerability is scoped to the local process and does not provide a direct path to code execution or lateral movement, but memory disclosure could facilitate further exploitation (Talos Advisory, Canva Advisory).

There is no confirmed public exploit or evidence of in-the-wild exploitation for CVE-2025-66617. The Cisco Talos report provides technical analysis including debugger output and structure details, but does not constitute actionable exploit code. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Talos Advisory).

1. Craft a malicious EMF file: Create an EMF file containing an EMR_POLYPOLYLINE16 record (recordType 0x0000005A) where the Count field (at offset 0x1C) is set to an excessively large value such that (0x20 + (4 * NumberOfPolylines) + (4 * Count)) exceeds the record's recordSize field.
2. Deliver the file to the target: Use social engineering, phishing, or a malicious download to place the crafted .emf file on the victim's Windows system where Canva Affinity (version < 3.1.0) is installed.
3. Induce the victim to open the file: Trick the user into opening the crafted EMF file with Canva Affinity (e.g., via double-click or file import), triggering the vulnerable DocumentController::TryLoadEMF → Emf::EmfLoader::LoadDocument code path.
4. Trigger out-of-bounds read: The parser calculates the aPoints array offset using NumberOfPolylines, then iterates Count times reading PointS objects. With an inflated Count, the loop reads beyond the allocated buffer, causing an access violation and potential memory disclosure.
5. Collect disclosed memory or observe crash: Depending on memory layout, the attacker may be able to infer sensitive in-process data from the read values, or at minimum cause the application to crash (Talos Advisory).

• File System: Presence of unexpected or unsolicited .emf files in user download directories, temp folders, or email attachments; files with EMR_POLYPOLYLINE16 records containing anomalously large Count values relative to recordSize.
• Process: Canva Affinity process (Affinity.exe or associated app) terminating unexpectedly with an access violation (c0000005) shortly after opening an EMF file; Windows Error Reporting (WER) crash dumps referencing libpersona.dll at offset +0x49f10.
• Logs: Windows Application Event Log entries showing application crashes for Canva Affinity; WER fault module listed as libpersona.dll with exception code 0xc0000005.

Canva released a patch in Affinity version 3.1.0, which addresses this vulnerability. Users should update Canva Affinity to version 3.1.0 or later immediately. As a temporary workaround until patching is possible, users should avoid opening EMF files from untrusted or unknown sources (Talos Advisory, Canva Advisory).

Cisco Talos published a detailed technical advisory (TALOS-2025-2315) on March 17, 2026, alongside a broader blog post covering multiple vendor vulnerabilities including TP-Link and Hikvision, which drew moderate community attention. The vulnerability was aggregated by standard CVE tracking platforms and security news outlets but did not generate significant independent researcher commentary or social media discussion, consistent with its medium severity and lack of active exploitation (Talos Blog).