CVE-2026-101130: Low severity Canva Affinity vulnerability
The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Affinity by Canvato a version that resolves this vulnerability.Fixed in 3.3.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Canva Affinity versions before 3.3.1 are exposed if they open a specially crafted Affinity document. Exploitation requires local access to the application and user interaction to open the file.
What could a malicious document do?
A crafted document can trigger a heap buffer over-read while Affinity parses arrays of strings. This may disclose adjacent heap-memory contents in the document text or cause the application to crash.
What version addresses the issue?
The issue is addressed in Affinity 3.3.1, identified as the October 2026 release.