Read the docs
TI-2026-70019 Aliases CVE-2026-101130GHSA-83mp-p4q2-qmmx

Heap buffer over-read in Affinity by Canva when parsing document files

Priority LOW 16CWE-126Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The Affinity by Canva application before 3.3.1 does not perform adequate bounds checking when parsing arrays of strings in Affinity document files, which causes a heap buffer over-read (CWE-126). A threat actor who crafts an Affinity document can make the application disclose adjacent heap memory in the document's text or crash when a user opens the file. Exploitation requires that a user open the crafted document.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00097 0th percentileScored 2026-11-07
Fix Fixed affinity (canva): 3.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canvaaffinitybefore 3.3.13.3.1Patch availableCNA
  • affinity VendorCanva Affected before 3.3.1 Fixed in 3.3.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*——Canva
  • cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:* Versions — — ·Canva

Remediation

Update Affinity by Canva to version 3.3.1 or later, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA affinity (canva) Fixed in 3.3.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    canva affinity 3.3.1

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-69991 Heap-based buffer overflow in Affinity by Canva QuickLook previewsPriority LOW 21
    • TI-2026-70020 Out-of-bounds read in Affinity by Canva raster image parsingPriority LOW 19
    • TI-2026-69992 Heap buffer over-read in Affinity by Canva when parsing document textPriority LOW 16
    Show all 7 records →

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-101130
  2. 2026-10-09 Alias added: GHSA-83mp-p4q2-qmmx
  3. 2026-10-10 CISA SSVC decision points changed

References

Other 1

  • TI-2026-82266 Ortto WordPress plugin missing authentication on config updates CVSS 3.1HIGH 8.6
  • TI-2026-58447 Improper verification of communication channel in Canva CVSS 3.1CRITICAL 9.6
  • TI-2026-58453 The Canva Android App before 2.376.0 did not restrict the headers returned to an external… CVSS 3.1HIGH 8.8
  • TI-2025-40808 Type confusion in Canva Affinity CVSS 3.1HIGH 7.8
  • TI-2025-39740 Out-of-bounds write in Canva Affinity CVSS 3.1HIGH 7.8
  • TI-2026-56261 Stack-based buffer overflow in Canva Affinity CVSS 3.1HIGH 7.7
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences