CVE-2026-20726
Published: 17 March 2026
Summary
CVE-2026-20726 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Canva Affinity. Its CVSS base score is 6.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 2.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the out-of-bounds read vulnerability by requiring timely application of vendor patches for Canva Affinity's EMF processing as advised in Talos and Canva guidance.
Implements memory protection mechanisms like ASLR and DEP to limit the impact of out-of-bounds reads that could disclose sensitive information.
Requires validation of EMF file inputs to detect and reject specially crafted files that trigger the out-of-bounds read vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds read in EMF file parser directly enables info disclosure via user-opened malicious file (T1204.002).
NVD Description
An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
Deeper analysisAI
CVE-2026-20726 is an out-of-bounds read vulnerability (CWE-125) in the EMF functionality of Canva Affinity. Published on 2026-03-17, it carries a CVSS v3.1 base score of 6.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L). The issue arises when processing a specially crafted EMF file, which can trigger an out-of-bounds read and potentially disclose sensitive information.
An attacker with local access can exploit this vulnerability by convincing a user to open a malicious EMF file, requiring low complexity and no privileges but relying on user interaction. Successful exploitation enables a high-impact confidentiality breach through information disclosure, alongside a low availability impact, but no integrity compromise.
Mitigation guidance is available in advisories from Talos Intelligence (TALOS-2025-2324) and Canva's trust center. Security practitioners should consult these references for patching instructions and workarounds specific to Canva Affinity.
Details
- CWE(s)