Read the docs
TI-2026-70020 Aliases CVE-2026-103220GHSA-42j6-qg67-fpwc

Out-of-bounds read in Affinity by Canva raster image parsing

Priority LOW 19CWE-129Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The Affinity by Canva application before 3.3.1 (October 2026 release) does not perform adequate bounds checking when parsing raster image data in Affinity document files. This leads to an out-of-bounds read and the dereference of an untrusted pointer, classified as CWE-129. An attacker can craft a document that, when a user opens it in Affinity, causes memory corruption or an application crash.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and the dereference of an untrusted pointer. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in memory corruption or an application crash.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00095 0th percentileScored 2026-11-07
Fix Fixed affinity (canva): 3.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canvaaffinitybefore 3.3.13.3.1Patch availableCNA
  • affinity VendorCanva Affected before 3.3.1 Fixed in 3.3.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:*——Canva
  • cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:* Versions — — ·Canva

Remediation

Update Affinity by Canva to version 3.3.1 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA affinity (canva) Fixed in 3.3.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    canva affinity 3.3.1

    7 records Highest priority Priority LOW 7 LOW

    Other records, highest priority first

    • TI-2026-69991 Heap-based buffer overflow in Affinity by Canva QuickLook previewsPriority LOW 21
    • TI-2026-70019 Heap buffer over-read in Affinity by Canva when parsing document filesPriority LOW 16
    • TI-2026-69992 Heap buffer over-read in Affinity by Canva when parsing document textPriority LOW 16
    Show all 7 records →

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-103220
  2. 2026-10-09 Alias added: GHSA-42j6-qg67-fpwc
  3. 2026-10-10 CISA SSVC decision points changed

References

Other 1

  • TI-2026-82266 Ortto WordPress plugin missing authentication on config updates CVSS 3.1HIGH 8.6
  • TI-2026-58447 Improper verification of communication channel in Canva CVSS 3.1CRITICAL 9.6
  • TI-2026-58453 The Canva Android App before 2.376.0 did not restrict the headers returned to an external… CVSS 3.1HIGH 8.8
  • TI-2025-40808 Type confusion in Canva Affinity CVSS 3.1HIGH 7.8
  • TI-2025-39740 Out-of-bounds write in Canva Affinity CVSS 3.1HIGH 7.8
  • TI-2026-56261 Stack-based buffer overflow in Canva Affinity CVSS 3.1HIGH 7.7
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences