Is CVE-2026-96393 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-96393?

CVE-2026-96393 has a CVSS v3 severity of LOW (3.6).

Back

CVE-2026-96393

Description

The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in an application crash.