CVE-2026-101094

LowCVSS 3.6/10Last modified Oct 9, 2026

Description

The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.

Metrics

CVSS 3.1 3.6/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-126

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
canva	affinity	< 3.3.1

References

https://trust.canva.com?tcuUid=1998378a-9134-47e9-b761-7a49d5fd6bfb

Timeline

Published: Oct 9, 2026
Last modified: Oct 9, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1010984.3A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by this issue is the function readAllBytes of CVE-2026-1010994.3A vulnerability was detected in ag-ui-protocol ag-ui up to 2026-09-23. This affects an unknown part of the file SseParser.kt of the componen CVE-2026-10116.1A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input s CVE-2026-101107.3A vulnerability was detected in code-projects Student Details Management System 1.0. This affects an unknown function of the file /index.php CVE-2026-1011005.4A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. This vulnerability affects the function FilterToolCallsMiddleware of the fil CVE-2026-1011014.3A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/conve CVE-2026-1011026.3A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7. Impacted is the function run_code of the component Code Mode San CVE-2026-1011035.5The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold the output record.CVE-2026-1011047.7The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the config CVE-2026-1011056.3A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofile_form of the file CVE-2026-1011078.6An OS command Injection issue exists in Air Terminal 6 provided by SoftBank Corp. Arbitrary commands may be executed with the root privilege CVE-2026-1011089.8Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_