CVE-2025-66633: 
Homebrew vulnerability analysis and mitigation

CVE-2025-66633 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) file handling functionality of Canva Affinity, specifically triggered by a malformed EMR_STRETCHBLT record. Discovered by KPC of Cisco Talos and disclosed to the vendor on January 27, 2026, the vulnerability was patched and publicly disclosed on March 17, 2026. It affects Canva Affinity version 3.0.1.3808 (Windows) and all versions prior to 3.1.0. The CVSSv3.1 base score is 6.1 (Medium) per Talos, with an alternate score of 7.1 (High) reported by NVD (Talos Advisory, Canva Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in libpersona.dll within the Emf::EmfLoader::LoadDocument function. When processing an EMR_STRETCHBLT record in a crafted EMF file, the application computes remaining_bitmap_data = offBitsSrc + cbBitsSrc - offBmiSrc - headerSize without validating whether this value exceeds the actual available record data (recordSize - offBmiSrc - headerSize). This unvalidated size is then passed to Dib::RasterHelper::CreateBitmapFromDib, which calls memcpy using the inflated size, causing an out-of-bounds read beyond the allocated buffer. Exploitation requires local access and user interaction — specifically, a victim must open a specially crafted EMF file in Canva Affinity on Windows (Talos Advisory).

Successful exploitation allows an attacker to read arbitrary memory within the Canva Affinity process, potentially exposing sensitive in-memory data such as document contents, credentials cached in memory, or other application data. The vulnerability also causes an access violation crash (code c0000005) during the memcpy operation, resulting in application unavailability. There is no integrity impact, and the scope is limited to the affected process; lateral movement is not directly facilitated by this vulnerability (Talos Advisory, Canva Advisory).

No confirmed in-the-wild exploitation has been observed, and no weaponized exploit code is publicly available. The Cisco Talos report provides detailed technical analysis including debugger output but does not include actionable exploit steps or a crafted payload. The EPSS score is approximately 0.012% (0.000120), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Talos Advisory).

1. Craft a malicious EMF file: Create an EMF file containing an EMR_STRETCHBLT record (recordType 0x0000004D) where the cbBitsSrc field is set to an inflated value such that offBitsSrc + cbBitsSrc - offBmiSrc - headerSize exceeds recordSize - offBmiSrc - headerSize.
2. Deliver the file to the target: Use social engineering (e.g., email attachment, shared drive, download link) to deliver the crafted .emf file to a user running Canva Affinity on Windows.
3. Trigger file opening: Convince the victim to open the malicious EMF file in any Canva Affinity application (Designer, Photo, Publisher), which invokes libpersona!DocumentController::TryLoadEMF.
4. Trigger out-of-bounds read: The application parses the EMR_STRETCHBLT record, computes the inflated remaining_bitmap_data value without bounds checking, and passes it to CreateBitmapFromDib, which calls memcpy with the oversized length.
5. Achieve memory disclosure or crash: The memcpy reads beyond the allocated buffer, potentially exposing adjacent heap memory contents to the attacker (if output is observable) or crashing the application with an access violation (Talos Advisory).

• File System: Presence of unexpected or unsolicited .emf files in user download directories, temp folders (%TEMP%), or email attachment staging areas.
• Process: Canva Affinity process (e.g., Affinity Designer.exe, Affinity Photo.exe, Affinity Publisher.exe) terminating unexpectedly with an access violation (exception code c0000005) shortly after opening a file.
• Logs: Windows Event Log entries (Application log) showing application crash events for Canva Affinity processes referencing libpersona.dll as the faulting module; crash dump files generated in %LOCALAPPDATA%\CrashDumps or similar paths referencing VCRUNTIME140!memcpy_repmovs.
• Network: Unusual inbound delivery of .emf files via email or web download from untrusted or unknown sources to systems running Canva Affinity.

Canva released a patch in Affinity version 3.1.0 on March 17, 2026; users should update to this version or later immediately (Canva Advisory). As a temporary workaround until patching is possible, users should avoid opening EMF files from untrusted or unknown sources. Organizations may also consider restricting .emf file type associations or implementing application whitelisting policies to prevent automated opening of potentially malicious EMF files in Canva Affinity.

Cisco Talos publicly disclosed the vulnerability alongside a detailed technical report (TALOS-2025-2313) on March 17, 2026, crediting researcher KPC for the discovery. Canva responded promptly by releasing a patch on the same day as public disclosure, following responsible disclosure initiated on January 27, 2026. The vulnerability was also covered in a Talos blog post grouping it with other vendor disclosures (TP-Link, Hikvision), indicating routine coordinated disclosure activity rather than an emergency response (Talos Advisory, Talos Blog).