CVE-2025-47873
Published: 17 March 2026
Summary
CVE-2025-47873 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Canva Affinity. Its CVSS base score is 6.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 2.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires identification, reporting, and correction of the out-of-bounds read flaw in Canva Affinity's EMF processing via timely patching.
Implements memory safeguards such as ASLR and DEP to block unauthorized out-of-bounds reads during EMF file parsing.
Validates specially crafted EMF inputs to prevent malformed files from triggering the out-of-bounds read vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OOB read in EMF parser enables local info disclosure (T1005) when user opens crafted malicious file (T1204.002).
NVD Description
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
Deeper analysisAI
CVE-2025-47873 is an out-of-bounds read vulnerability (CWE-125) in the EMF functionality of Canva Affinity software. Published on 2026-03-17, it carries a CVSS v3.1 base score of 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L). The flaw can be triggered by processing a specially crafted EMF file, enabling an out-of-bounds read that may disclose sensitive information.
A local attacker can exploit this vulnerability by tricking a user into opening a malicious EMF file within Canva Affinity. No special privileges are required, though the attack demands low complexity and user interaction. Exploitation yields high confidentiality impact via information disclosure, with no integrity impact and only low availability impact.
Mitigation guidance is available in advisories from Talos Intelligence (TALOS-2025-2316) and Canva's trust center.
Details
- CWE(s)