CVE-2026-81546CWE-121

CVE-2026-81546

High · published September 17, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
3.6
In the wild
Unconfirmed
What it is

The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when parsing Affinity document files leading to a stack-based buffer overflow. A threat actor could craft a Affinity document that when opened by a user in Affinity could result in arbitrary code execution.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00147 · 3.6th percentile
Weakness
CWE-121 · Stack-based Buffer Overflow
Published
2026-09-17T06:16Z
References (1)
https://trust.canva.com?tcuUid=43596908-8a36-4a18-b2e7-5c99b67ab38a · 61adb53e-e4b3-47f7-8a93-4717c9e77dc6
EPSS history
Timeline
  • 18 SEP 04:01Z
    EPSS moved — → 0%
    epss
  • 17 SEP 01:39Z
    The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when parsing Affinity document files leading…
    cvelistv5