Read the docs
TI-2026-69990 Aliases CVE-2026-96395GHSA-7c2g-55x8-755j

Affinity by Canva for macOS QuickLook out-of-bounds heap read

Priority LOW 16CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) does not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity document files. This out-of-bounds read (CWE-125) lets a threat actor craft a document that, when a user displays or previews it in Finder, discloses adjacent heap memory, including memory addresses, in the rendered image. The attack requires user interaction. The CVSS 3.1 base score is 3.6 (LOW), with low confidentiality and availability impact.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory, including memory addresses, in the rendered thumbnail or preview image.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00091 0th percentileScored 2026-11-07
Fix Fixed affinity (canva): 3.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canvaaffinitybefore 3.3.13.3.1Patch availableCNA
  • affinity VendorCanva Affected before 3.3.1 Fixed in 3.3.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*——Canva
  • cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:* Versions — — ·Canva

Remediation

Update the Affinity by Canva app for macOS to version 3.3.1 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA affinity (canva) Fixed in 3.3.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    canva affinity 3.3.1

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-69991 Heap-based buffer overflow in Affinity by Canva QuickLook previewsPriority LOW 21
    • TI-2026-70020 Out-of-bounds read in Affinity by Canva raster image parsingPriority LOW 19
    • TI-2026-70019 Heap buffer over-read in Affinity by Canva when parsing document filesPriority LOW 16
    Show all 7 records →

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-96395
  2. 2026-10-09 Alias added: GHSA-7c2g-55x8-755j
  3. 2026-10-10 CISA SSVC decision points changed

References

Other 1

  • TI-2026-82266 Ortto WordPress plugin missing authentication on config updates CVSS 3.1HIGH 8.6
  • TI-2026-58447 Improper verification of communication channel in Canva CVSS 3.1CRITICAL 9.6
  • TI-2026-58453 The Canva Android App before 2.376.0 did not restrict the headers returned to an external… CVSS 3.1HIGH 8.8
  • TI-2025-40808 Type confusion in Canva Affinity CVSS 3.1HIGH 7.8
  • TI-2025-39740 Out-of-bounds write in Canva Affinity CVSS 3.1HIGH 7.8
  • TI-2026-56261 Stack-based buffer overflow in Canva Affinity CVSS 3.1HIGH 7.7
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences