Canva Affinity Out-of-Bounds Read Vulnerability in EMF Processing

A vulnerability allowing out-of-bounds read operations has been identified in Canva Affinity version 3.0.1.3808. This issue arises within the application's EMF (Enhanced Metafile Format) functionality, where the software fails to properly validate the 'nDescription' field of the EMF header. As a result, an attacker can craft a malicious EMF file that, when opened in Canva Affinity, triggers the vulnerability by reading beyond the allocated memory bounds. This exploitation could lead to the unintended disclosure of sensitive information.

Impact

Exploitation of this vulnerability allows for arbitrary memory reading within the Canva Affinity process, potentially revealing sensitive information.

Reproduction

The vulnerability can be reproduced by creating a specially crafted EMF file that exploits the unvalidated 'nDescription' field in the EMF header. When this file is opened in Canva Affinity version 3.0.1.3808, the application will perform an out-of-bounds read, accessing memory that should not be available, which can be observed using debugging tools.

Remediation

Users are advised to upgrade to the latest version of Canva Affinity available from the Affinity website.