CyberRota Analysis
AI-GeneratedThe Affinity by Canva application for macOS prior to version 3.3.1 is vulnerable due to improper validation of image dimensions, which can lead to out-of-bounds heap reads when generating QuickLook thumbnails. This flaw may allow an attacker to craft a malicious Affinity document that discloses adjacent heap memory contents or crashes the thumbnail preview extension. Users and organizations relying on this application for document handling should prioritize updating to the latest version to mitigate potential information disclosure risks.
Original NVD Description
The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory in the rendered thumbnail or preview image, or cause the thumbnail or preview extension to crash.