CVE-2026-96394

LowCVSS 2.9/10Last modified Oct 9, 2026

Description

The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory in the rendered thumbnail or preview image, or cause the thumbnail or preview extension to crash.

Metrics

CVSS 3.1 2.9/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-126

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 9, 2026
Last modified: Oct 9, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-963953.6The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook t CVE-2026-963964.9The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when ge CVE-2026-963984.3Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing. This issue affects Webform versions: from 0.0.0 to 6.2.12,CVE-2026-963997.5A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gite CVE-2026-96407.2A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling CVE-2026-964004.3With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permi CVE-2026-964025.2A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap CVE-2026-964048.1When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `fals CVE-2026-964055.3NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has CVE-2026-964064.9A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of its input header. Th CVE-2026-964089.3A code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbit CVE-2026-96415.3Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations. The default algorithm is HMAC-SHA1,