CVE-2026-101094
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle...
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.
- Record
CVE-2026-101094- CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L - Weakness
- CWE-126
- Updated
- 2026-11-02
EUVDEUVD-2026-95752
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.
- Record
EUVD-2026-95752- CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h877-95q5-3r86
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle...
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.
- Record
GHSA-h877-95q5-3r86- CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L - Weakness
- CWE-126
- Updated
- 2026-11-02
NVD
The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.
- Record
CVE-2026-101094- CVSS 3.1
- 3.6 Low
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L - Weakness
- CWE-126
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-101094 is a low vulnerability (CVSS 3.6) in Canva Affinity, published October 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.10%, the 0th percentile. No source names a fixed version.