CVE-2026-96395: Low severity Canva Affinity by Canva vulnerability

Q: Who is exposed to this issue?

Users of the Affinity by Canva app on macOS before version 3.3.1 are exposed when Finder generates a QuickLook thumbnail or preview for an Affinity document.

Q: What must an attacker do to trigger the issue?

An attacker must provide a crafted Affinity document and have a user display or preview that file in Finder. The issue can disclose adjacent heap-memory contents, including memory addresses, through the rendered thumbnail or preview image.

Q: Are default Finder preview features affected?

Yes. The affected processing occurs while generating QuickLook thumbnails and previews, so merely displaying or previewing a crafted document in Finder can trigger it.

Q: How can I remediate the issue?

Update Affinity by Canva for macOS to version 3.3.1 or later. The affected versions are those before 3.3.1.

Published Oct 9, 2026

Updated

The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory, including memory addresses, in the rendered thumbnail or preview image.

Affected Software

1 affected component

Canva Affinity by Canva<3.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Affinity by Canva for macOS to a version that resolves this vulnerability.
Fixed in 3.3.1

Event History

Oct 9, 2026

CVE Published

via MITRE·12:40 PM

Data Sourced

via MITRE·12:40 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of the Affinity by Canva app on macOS before version 3.3.1 are exposed when Finder generates a QuickLook thumbnail or preview for an Affinity document.

What must an attacker do to trigger the issue?

An attacker must provide a crafted Affinity document and have a user display or preview that file in Finder. The issue can disclose adjacent heap-memory contents, including memory addresses, through the rendered thumbnail or preview image.

Are default Finder preview features affected?

Yes. The affected processing occurs while generating QuickLook thumbnails and previews, so merely displaying or previewing a crafted document in Finder can trigger it.

How can I remediate the issue?

Update Affinity by Canva for macOS to version 3.3.1 or later. The affected versions are those before 3.3.1.

CVE-2026-96395: Low severity Canva Affinity by Canva vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to trigger the issue?

Are default Finder preview features affected?

How can I remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to trigger the issue?

Are default Finder preview features affected?

How can I remediate the issue?