CVE-2026-81546

CVE-2026-81546 is a stack-based buffer overflow (CWE-121) in the Affinity by Canva application, caused by inadequate bounds checking when parsing Affinity document files. An attacker triggers it by crafting a malicious Affinity document and convincing a user to open it in the app, consistent with the CVSS vector (AV:L/PR:N/UI:R/AC:H), which requires local delivery and user interaction. Successful exploitation could result in arbitrary code execution in the context of the user running Affinity, with high impact to confidentiality, integrity, and availability. All users running Affinity before version 3.3.0 are affected. There are no known public proof-of-concepts, no reports of in-the-wild exploitation, and the flaw is not listed in CISA KEV.

What to do: Upgrade Affinity to version 3.3.0 (the September 2026 release) or later, and verify the installed version via the app's About/settings screen. Until patched, avoid opening Affinity document files from untrusted or unknown sources, since no workaround for the parser flaw is documented. Monitor vendor advisories for any updates on exploitation status.