CVE-2026-20726: 
Homebrew vulnerability analysis and mitigation

CVE-2026-20726 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) file parsing functionality of Canva Affinity, specifically triggered by a malformed EMR_POLYBEZIERTO16 record. Discovered by KPC of Cisco Talos and disclosed to the vendor on January 27, 2026, the patch was released and publicly disclosed on March 17, 2026. The confirmed vulnerable version is Canva Affinity 3.0.1.3808 on Windows, with all versions prior to 3.1.0 affected. It carries a CVSS v3.1 base score of 6.1 (Medium) per the Talos advisory (Talos Advisory, Canva Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and resides in libpersona.dll within the Emf::EmfLoader::LoadDocument function. The flaw occurs when processing an EMR_POLYBEZIERTO16 record whose Count (N) field is set to an excessively large value such that 0x1C + (4 * N) exceeds the record's declared recordSize. The parser verifies that Count is non-zero but does not validate that the computed array size fits within the record boundary; it then enters a loop reading PointS objects from the aPoints array, iterating past the end of the allocated buffer and triggering an access violation (c0000005). Exploitation requires a user to open a specially crafted EMF file, making user interaction a necessary precondition (Talos Advisory).

Successful exploitation can result in the disclosure of sensitive in-process memory contents and may cause the Affinity application to crash (denial of service). The out-of-bounds read allows an attacker to read arbitrary memory within the Affinity process, potentially exposing data such as document contents, credentials cached in memory, or other sensitive information loaded by the application. Integrity is not directly impacted, and the vulnerability does not provide a direct code execution primitive; however, memory disclosure could facilitate further exploitation (Talos Advisory, Canva Advisory).

No confirmed in-the-wild exploitation has been observed, and no functional exploit code or proof-of-concept is publicly available — the Talos report provides only a technical analysis with debugger output, not actionable attack steps. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and user interaction (opening a malicious EMF file), which limits the attack surface (Talos Advisory).

1. Craft a malicious EMF file: Create an EMF file containing a valid EMR_HEADER record followed by an EMR_POLYBEZIERTO16 record (recordType 0x00000058). Set the Count field at offset 0x18 to an excessively large value (e.g., 0x03FFFFFF) such that 0x1C + (4 * Count) far exceeds the recordSize field at offset 0x04.
2. Deliver the file to the target: Use social engineering, phishing, or a malicious download to deliver the crafted .emf file to a system running Canva Affinity version prior to 3.1.0 on Windows.
3. Trigger file opening: Induce the victim to open the crafted EMF file with Canva Affinity (e.g., by embedding it in a project or sending it directly). The application's DocumentController::TryLoadEMF → Emf::EmfLoader::LoadDocument code path is invoked.
4. Out-of-bounds read occurs: The parser validates that Count is non-zero but does not check that the full aPoints array fits within recordSize. The loop reads PointS objects past the end of the allocated buffer, disclosing adjacent memory contents or crashing the application with an access violation.
5. Collect disclosed memory: In a controlled exploitation scenario, the attacker would need a secondary channel (e.g., a crafted document that exfiltrates data) to retrieve the out-of-bounds memory contents, as this is a read-only primitive (Talos Advisory).

• File System: Unexpected or unsolicited .emf files delivered via email attachments, downloads, or shared drives, particularly those with anomalously small recordSize values relative to their Count fields in EMR_POLYBEZIERTO16 records.
• Process: Canva Affinity process (Affinity.exe or associated processes) crashing with an access violation (c0000005) in libpersona.dll at the Emf::EmfLoader::LoadDocument function offset +0x48870.
• Logs: Windows Error Reporting (WER) crash dumps referencing libpersona.dll with a faulting module path under C:\Program Files\WindowsApps\Canva.Affinity_*\App\libpersona.dll.
• Network: Unusual inbound delivery of .emf files from external or untrusted sources to users running Canva Affinity (Talos Advisory).

Canva has released Affinity version 3.1.0, which addresses this vulnerability; all users should update immediately. Until the patch is applied, users should avoid opening EMF files from untrusted or unknown sources. No additional configuration-based workaround has been published by the vendor (Canva Advisory, Talos Advisory).

Cisco Talos published a detailed technical advisory (TALOS-2025-2324) on March 17, 2026, crediting researcher KPC for the discovery. The Talos blog also covered this vulnerability alongside other vendor disclosures in a broader roundup post. Community and media coverage has been limited, consistent with the moderate severity and lack of active exploitation (Talos Blog, Talos Advisory).