Heap Buffer Over-Read in Affinity by Canva

Executive Summary

The Affinity by Canva application before version 3.3.1 has a flaw where it fails to properly check the size of arrays of strings in Affinity document files. This can cause the program to read beyond the intended memory area, potentially exposing sensitive data or crashing the application.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a heap buffer over-read in Affinity by Canva when parsing Affinity document files. Detection requires inspecting files opened with Affinity for unusual memory access patterns or crashes. Monitor application logs for segmentation faults or memory errors during file parsing. Check for application crashes when opening specific documents.

Useful 0 Not Useful 0

Impact Analysis

If you open a specially crafted Affinity document, an attacker could access parts of your computer's memory that contain private information. The attacker might also cause the application to crash, leading to loss of unsaved work.

Useful 0 Not Useful 0

Mitigation Strategies

Update Affinity by Canva to version 3.3.1 or later to address the bounds checking issue. Avoid opening untrusted Affinity documents until the update is applied. If immediate update is not possible, restrict document access to trusted sources only.

Useful 0 Not Useful 0