Canva Affinity Out-of-Bounds Read Vulnerability in EMF Functionality

A vulnerability allowing out-of-bounds read has been identified in the EMF processing of Canva Affinity version 3.0.1.3808. This issue arises when a specially crafted EMF file is used, leading to the potential disclosure of sensitive information by exploiting the way intercharacter spacing data is accessed.

Impact

Exploitation of this vulnerability allows for arbitrary memory reading within the process, which could result in the unintentional exposure of sensitive information.

Reproduction

The vulnerability can be reproduced by opening a crafted EMF file in Canva Affinity. The file must be designed to exploit the EMR_EXTTEXTOUTW record by setting the offDx value to exceed the record size, causing an out-of-bounds read when the intercharacter spacing array is accessed.

Remediation

Users are advised to upgrade to the latest version of Canva Affinity available from the Affinity website.