CVE-2026-103220
Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: Canva

Description
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and the dereference of an untrusted pointer. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in memory corruption or an application crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-19
AI Q&A
2026-10-09
EPSS Evaluated
2026-10-18
NVD
CVE-2026-103220
EUVD
EUVD-2026-95754

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
canva affinity 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Affinity by Canva application before version 3.3.1 has a flaw where it fails to properly check the bounds of raster image data in Affinity document files. This oversight allows an out-of-bounds read, which can lead to memory corruption or the application crashing when a specially crafted document is opened.

Detection Guidance

This vulnerability involves an out-of-bounds read in Affinity by Canva when processing raster image data in Affinity document files. Detection requires checking the installed version of Affinity by Canva. If the version is below 3.3.1, the system is vulnerable.

Impact Analysis

If you open a malicious Affinity document, the vulnerability could cause your application to crash or corrupt memory. This might lead to data loss or unexpected behavior, though it requires user interaction to exploit.

Compliance Impact

The vulnerability involves an out-of-bounds read and untrusted pointer dereference in Affinity by Canva, which could lead to memory corruption or application crashes. This may impact compliance with standards like GDPR or HIPAA if sensitive data is processed or stored in affected documents, potentially exposing data integrity or confidentiality.

Mitigation Strategies

Update the Affinity by Canva application to version 3.3.1 or later to address the bounds checking issue in raster image data parsing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103220. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart