Cyber Posture

CVE-2025-62500

MediumPublic PoC

Published: 17 March 2026

Published
17 March 2026
Modified
19 March 2026
KEV Added
Patch
CVSS Score 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L
EPSS Score 0.0001 2.5th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-62500 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Canva Affinity. Its CVSS base score is 6.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 2.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Malicious File (T1204.002). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly remediates the out-of-bounds read vulnerability in Canva Affinity's EMF parser through timely patching as specified in vendor advisories.

prevent

Implements memory protections like ASLR and DEP to prevent unauthorized out-of-bounds reads from disclosing sensitive memory contents during EMF file processing.

prevent

Validates specially crafted EMF file inputs to ensure they conform to expected formats, mitigating malformed data that triggers the out-of-bounds read.

MITRE ATT&CK Enterprise TechniquesAI

T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

OOB read in EMF parser enables info disclosure via crafted file opened by user (T1204.002 Malicious File).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.

Deeper analysisAI

CVE-2025-62500 is an out-of-bounds read vulnerability (CWE-125) in the EMF functionality of Canva Affinity. The issue, published on 2026-03-17, allows exploitation via a specially crafted EMF file, potentially leading to the disclosure of sensitive information. It has a CVSS v3.1 base score of 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L), indicating medium severity with high confidentiality impact but low availability impact.

An attacker with local access can exploit this vulnerability by tricking a user into opening a malicious EMF file in Canva Affinity, requiring no privileges or special attacker conditions beyond low-complexity preparation and user interaction. Successful exploitation triggers an out-of-bounds read, enabling potential leakage of sensitive memory contents, though integrity and availability impacts are minimal.

Mitigation details are available in advisories from Talos Intelligence (TALOS-2025-2298) and Canva's trust center (trust.canva.com). Security practitioners should consult these references for patch information, workarounds, and affected versions.

Details

CWE(s)

Affected Products

canva
affinity
≤ 3.1.0

CVEs Like This One

CVE-2025-64735Same product: Canva Affinity
CVE-2025-65119Same product: Canva Affinity
CVE-2026-22882Same product: Canva Affinity
CVE-2025-62403Same product: Canva Affinity
CVE-2026-20726Same product: Canva Affinity
CVE-2025-61979Same product: Canva Affinity
CVE-2025-66503Same product: Canva Affinity
CVE-2025-64733Same product: Canva Affinity
CVE-2025-66617Same product: Canva Affinity
CVE-2025-58427Same product: Canva Affinity

References