CVE-2025-61952

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published: Mar 17, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-619558.8A vulnerability exists in F5OS-A and F5OS-C systems that may allow an authenticated attacker with local access to escalate their privileges.CVE-2025-619569.8Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. Atta CVE-2025-619588.7A vulnerability exists in the iHealth command that may allow an authenticated attacker with at least a resource administrator role to bypass CVE-2025-619595.3Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests CVE-2025-61965.5A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially craft CVE-2025-619607.5When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management M CVE-2025-619625.9In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed context.CVE-2025-619697.0Incorrect permission assignment in AMD µProf may allow a local user-privileged attacker to achieve privilege escalation, potentially resulti CVE-2025-61974.2An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: -CVE-2025-619701.0Weak permissions in the Vitis™ Unified installation path on local Windows machines could allow a low-privileged user to create arbitrary cod CVE-2025-619715.9Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to modify MMIO routing configurations, potentia CVE-2025-619728.5Missing lock bit protection for NBIO registers could allow a local admin-privileged attacker to gain arbitrary System Management Network (SM