CVE-2026-96394: Low severity Canva Affinity vulnerability
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory in the rendered thumbnail or preview image, or cause the thumbnail or preview extension to crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Affinity by Canva for macOSto a version that resolves this vulnerability.Fixed in 3.3.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
macOS users running Canva Affinity before version 3.3.1 are exposed when Finder generates a QuickLook thumbnail or preview for a crafted Affinity document.
What does an attacker need to do to trigger the flaw?
An attacker needs to provide a crafted Affinity document with image dimensions that do not match its pixel-data size. The document must then be displayed or previewed in Finder by the user.
What is the likely impact?
The malformed document can cause an out-of-bounds heap read, potentially disclosing adjacent heap memory through the rendered thumbnail or preview image. It can also crash the thumbnail or preview extension.
How can I remediate the issue?
Update Canva Affinity for macOS to version 3.3.1 or later, identified as the October 2026 release.