CVE-2026-22882: 
Homebrew vulnerability analysis and mitigation

CVE-2026-22882 is an out-of-bounds read vulnerability in the EMF (Enhanced Metafile Format) file parsing functionality of Canva Affinity, specifically triggered by a malformed EMR_POLYPOLYLINE record. Discovered by KPC of Cisco Talos and disclosed on March 17, 2026, it affects Canva Affinity version 3.0.1.3808 on Windows (all versions prior to 3.1.0). The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) per the Talos advisory, though Feedly's aggregated data notes a score of 7.1 (Talos Advisory, Canva Advisory).

The root cause is classified as CWE-125 (Out-of-bounds Read) in the libpersona.dll component's Emf::EmfLoader::LoadDocument function. The vulnerability arises when processing an EMR_POLYPOLYLINE record (recordType 0x00000007) where the computed data size (0x20 + (4 * P) + (4 * N)) exceeds the declared recordSize — the parser incorrectly reads PointS objects (4 bytes each) instead of the expected PointL objects (8 bytes each), and fails to validate that the Count field does not exceed the actual buffer bounds. An attacker crafts an EMF file with an inflated Count value in the EMR_POLYPOLYLINE record, causing the application to iterate beyond allocated memory during the point-reading loop, resulting in an access violation (c0000005) (Talos Advisory).

Successful exploitation allows an attacker to read arbitrary memory within the Affinity process, potentially disclosing sensitive in-memory information such as document content, credentials, or other data loaded by the application. Additionally, the out-of-bounds read causes an application crash, resulting in a denial-of-service condition for the affected user. The attack is local and requires user interaction (opening a malicious EMF file), limiting its scope to the affected workstation without direct lateral movement potential (Talos Advisory, Canva Advisory).

No confirmed in-the-wild exploitation has been observed, and no weaponized exploit code is publicly available. The Cisco Talos report (TALOS-2025-2325) provides technical analysis and debugging traces but does not include a ready-to-use exploit or crafted EMF file. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Talos Advisory).

1. Craft a malicious EMF file: Create an EMF file containing a valid EMR_HEADER record followed by an EMR_POLYPOLYLINE record (recordType 0x00000007) where the Count (N) field is set to an excessively large value such that (0x20 + (4 * P) + (4 * N)) exceeds the declared recordSize.
2. Deliver the file to the target: Use social engineering (e.g., email attachment, shared document link, or malicious download) to convince a user running Canva Affinity 3.0.1.3808 on Windows to open the crafted EMF file.
3. Trigger parsing: When the victim opens the file in any Affinity application (Designer, Photo, Publisher), the libpersona.dll EMF loader processes the EMR_POLYPOLYLINE record and enters a loop iterating Count times over the aPoints array.
4. Out-of-bounds read occurs: The parser reads beyond the allocated buffer boundary, accessing unmapped or adjacent memory. Depending on memory layout, this may expose sensitive in-process data or trigger an access violation crash.
5. Achieve objective: Memory contents read out-of-bounds may be observable through application behavior or crash dumps, potentially disclosing sensitive information; the crash itself constitutes a denial-of-service (Talos Advisory).

• File System: Presence of unexpected or unsolicited .emf files in user download directories, temp folders (%TEMP%), or email attachment staging areas; EMF files with anomalously small recordSize values relative to their Count fields in EMR_POLYPOLYLINE records.
• Process: Canva Affinity application (Designer.exe, Photo.exe, Publisher.exe) crashing with access violation exception code c0000005 shortly after opening an EMF file; crash dumps referencing libpersona!Emf::EmfLoader::LoadDocument in the call stack.
• Logs: Windows Event Log entries (Application log) showing application crash events for Affinity processes; Windows Error Reporting (WER) crash reports for libpersona.dll at offsets consistent with +0x4a500.

Canva released a patch on March 17, 2026; users should update Canva Affinity to version 3.1.0 or later to remediate this vulnerability. As a temporary workaround until patching is feasible, users should avoid opening EMF files from untrusted or unknown sources, and administrators can restrict access to the Affinity application for users who do not require it. No additional configuration-based mitigations have been published by the vendor (Canva Advisory, Talos Advisory).

Cisco Talos published the formal vulnerability report (TALOS-2025-2325) on March 17, 2026, crediting researcher KPC for the discovery, and noted coordinated disclosure with Canva beginning January 27, 2026. The Talos blog also covered this vulnerability alongside other vendor disclosures in a broader roundup post. No significant independent researcher commentary or notable social media discussion has been identified beyond standard vulnerability database aggregation (Talos Blog, Talos Advisory).