Canva Affinity Out-of-Bounds Read Vulnerability in EMF Processing

A vulnerability allowing out-of-bounds read has been identified in Canva Affinity version 3.0.1.3808. This issue arises in the application's EMF (Enhanced Metafile Format) functionality, where a specially crafted EMF file can be used to exploit the vulnerability. The out-of-bounds read could lead to the unauthorized disclosure of sensitive information.

Impact

Exploitation of this vulnerability allows for arbitrary memory reading within the process, potentially revealing sensitive information.

Reproduction

The vulnerability can be reproduced by opening a specially crafted EMF file in Canva Affinity. The file must be designed to exploit the EMF processing, specifically by manipulating the 'EMR_EXTSELECTCLIPRGN' record to cause an out-of-bounds read. This can be done by exceeding the 'RgnDataSize' field, which leads to accessing memory outside the intended buffer, creating a read access violation that can be observed while debugging.

Remediation

Users are advised to upgrade to the latest version of Canva Affinity available from the Affinity website.