CVE-2026-81546

The Affinity by Canva application for macOS before version 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could corrupt heap memory and cause the thumbnail or preview extension to crash.

The Affinity by Canva app for macOS before version 3.3.1 did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed in Finder, could disclose the contents of adjacent heap memory, including memory addresses, in the rendered thumbnail or preview image.

The Affinity by Canva application for macOS before 3.3.1 did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A crafted Affinity document, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory in the rendered thumbnail or preview image, or cause the thumbnail or preview extension to crash.

The Affinity by Canva app before 3.3.1 did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A crafted Affinity document, when opened by a user in Affinity, could result in an application crash.

Affinity by Canva before version 3.3.1 did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and dereference of an untrusted pointer. A crafted document could cause memory corruption or application crash.

The Affinity by Canva application before 3.3.1 did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A crafted Affinity document, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.

The Affinity by Canva application before 3.3.1 did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A crafted Affinity document, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.