CVE-2026-101094
Received Received - Intake

Heap Buffer Over-read in Affinity by Canva

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: 61adb53e-e4b3-47f7-8a93-4717c9e77dc6

Description
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-101094
EUVD
EUVD-2026-95752

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
canva affinity 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-126 The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Affinity by Canva application before version 3.3.1 mishandles incomplete UTF-8 character sequences in Affinity document files. This causes a heap buffer over-read, potentially exposing adjacent memory contents or crashing the application when a specially crafted document is opened.

Detection Guidance

This vulnerability can be detected by checking the version of Affinity by Canva installed on your system. If the version is below 3.3.1, the application is vulnerable. No specific commands are provided in the context to detect this issue.

Impact Analysis

An attacker could exploit this to read sensitive data from memory or cause the application to crash when opening a malicious document. This may lead to information disclosure or denial of service on affected systems.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, potentially violating GDPR or HIPAA requirements for data protection and confidentiality. Organizations may face compliance risks if sensitive data is leaked through this flaw.

Mitigation Strategies

Immediately update Affinity by Canva to version 3.3.1 or later to address the vulnerability. Avoid opening untrusted Affinity document files until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101094. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart