Canva is a modestly represented design and creative software vendor, and as a CNA it independently discloses vulnerabilities in its own products and those of affiliated entities such as Affinity. Its vulnerability profile clusters around memory-safety issues—out-of-bounds reads and writes, and type-confusion flaws—which are characteristic of native codebases handling complex graphics and document processing. Current severity, exploitation, and CVE counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Canva over time
Signals from CVEs in this vendor scope (19 CVEs).
19 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-66342HIGH A type confusion vulnerability exists in the EMF functionality of Canva Affinity. A specially crafted EMF file can trigger this vulnerability, which can lead to memory corruption a | Mar 17, 2026 | 7.8 | 27 | NO | NO |
CVE-2025-64301HIGH An out‑of‑bounds write vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perfo | Mar 17, 2026 | 7.8 | 26 | NO | NO |
CVE-2026-22882HIGH An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perfor | Mar 17, 2026 | 7.1 | 24 | NO | NO |
CVE-2026-20726HIGH An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perfor | Mar 17, 2026 | 7.1 | 24 | NO | NO |
CVE-2025-66633HIGH An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perfor | Mar 17, 2026 | 7.1 | 24 | NO | NO |
CVE-2025-66617HIGH An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perfor | Mar 17, 2026 | 7.1 | 24 | NO | NO |
CVE-2025-66503HIGH An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perfor | Mar 17, 2026 | 7.1 | 24 | NO | NO |
CVE-2025-66042HIGH An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perfor | Mar 17, 2026 | 7.1 | 24 | NO | NO |
CVE-2025-66000HIGH An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perfor | Mar 17, 2026 | 7.1 | 24 | NO | NO |
CVE-2025-65119HIGH An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perfor | Mar 17, 2026 | 7.1 | 24 | NO | NO |
Signals from CVEs in this vendor scope (19 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Canva.
Media articles that mention a CVE ID that affects a product developed by Canva — matched by CVE ID, not by vendor name.