Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| canva | affinity | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 09 Oct 2026 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Affinity Document Parsing Heap Over‑Read Leading to Information Disclosure or Crash |
Fri, 09 Oct 2026 12:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash. | |
| First Time appeared |
Canva
Canva affinity |
|
| Weaknesses | CWE-126 | |
| CPEs | cpe:2.3:a:canva:affinity:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Canva
Canva affinity |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: Canva
Published:
Updated: 2026-10-09T12:44:18.174Z
Reserved: 2026-09-28T01:31:06.889Z
Link: CVE-2026-101094
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-09T13:17:05.890
Modified: 2026-10-09T13:17:05.890
Link: CVE-2026-101094
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-09T13:30:05Z
-
CWE-126
Buffer Over-read