Security Bulletin

CVE-2026-113409

CVE: CVE-2026-113409
Severity: Medium
CVSS: 4.8 – CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected Products and Versions

• Ortto plugin for WordPress before 1.0.25

Details

The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted page.

Remediation Advice

Canva recommends users upgrade to the latest version of the Ortto plugin for WordPress.

Timeline

• Oct 20 2026 – Discovered by Canva
• Oct 29 2026 – Fix released

Acknowledgements

This vulnerability was discovered by Canva's Security Group.

Security Bulletin

CVE-2026-114173

CVE: CVE-2026-114173
Severity: Medium
CVSS: 5.3 – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Products and Versions

• Ortto plugin for WordPress before 1.0.25

Details

The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store.

Remediation Advice

Canva recommends users upgrade to the latest version of the Ortto plugin for WordPress. Merchants who use password-protected products should also change those product passwords after upgrading.

Timeline

• Oct 21 2026 – Discovered by Canva
• Oct 29 2026 – Fix released

Acknowledgements

This vulnerability was discovered by Canva's Security Group.

Security Bulletin

CVE-2026-113387

CVE: CVE-2026-113387
Severity: High
CVSS: 8.6 – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Affected Products and Versions

• Ortto plugin for WordPress before 1.0.25

Details

The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite the plugin's configuration to serve arbitrary scripts.

Remediation Advice

Canva recommends users upgrade to the latest version of the Ortto plugin for WordPress.

Timeline

• Oct 14 2026 – Findings reported to Canva
• Oct 20 2026 – Vulnerability triaged by Canva and accepted
• Oct 29 2026 – Fix released

Acknowledgements

This vulnerability was submitted to Canva's Bug Bounty Program by Sh3kaf.

Security Bulletin

CVE-2026-115570

CVE: CVE-2026-115570
Severity: High
CVSS: 7.4 – CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Products and Versions

• Canva for Mac desktop app before 1.126.2
• Canva for Windows desktop app before 1.126.2
• remove.bg desktop app before 3.0.1

Canva mobile applications are not affected.

Details

A set of eMudhra intermediate certificates were compromised and are being blocked by browsers and other TLS clients.

The Canva for Mac and Canva for Windows desktop apps from 1.126.2 no longer trust these intermediate certificates.

The remove.bg desktop app from 3.0.1 no longer trusts these certificates.

Remediation Advice

Canva recommends users upgrade to the latest version of the Canva desktop app for their platform.

Canva recommends users upgrade to the latest version of the remove.bg app for their platform.

Canva recommends users upgrade their operating systems to the latest version for their platform.

Timeline

• Oct 21 2026 – Impact to the Canva desktop app and remove.bg app identified by Canva
• Oct 22 2026 – Fix released in Canva for Mac and Canva for Windows desktop apps v1.126.2
• Oct 22 2026 – Fix released in remove.bg desktop app v3.0.1

Security Bulletin

CVE-2026-96393

CVE: CVE-2026-96393
Severity: Low
CVSS: 3.6 – CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

Affected Products and Versions

• Affinity by Canva app before 3.3.1

Details

The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in an application crash.

Remediation Advice

Canva recommends users upgrade to the latest version of the Affinity application for their platform.

Timeline

• Sep 17 2026 – Findings reported to Canva
• Sep 28 2026 – Vulnerability triaged by Canva and accepted
• Oct 8 2026 – Fix released

Acknowledgements

This vulnerability was submitted to Canva by Xusheng Li.

CVE-2026-96394

CVE: CVE-2026-96394
Severity: Low
CVSS: 2.9 – CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Products and Versions

• Affinity by Canva app for macOS before 3.3.1

Details

The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory in the rendered thumbnail or preview image, or cause the thumbnail or preview extension to crash.

Remediation Advice

Canva recommends users upgrade to the latest version of the Affinity application for macOS.

Timeline

• Sep 17 2026 – Findings reported to Canva
• Sep 22 2026 – Vulnerability triaged by Canva and accepted
• Oct 8 2026 – Fix released

Acknowledgements

This vulnerability was submitted to Canva by Xusheng Li.

CVE-2026-96395

CVE: CVE-2026-96395
Severity: Low
CVSS: 3.6 – CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L

Affected Products and Versions

• Affinity by Canva app for macOS before 3.3.1

Details

The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory, including memory addresses, in the rendered thumbnail or preview image.

Remediation Advice

Canva recommends users upgrade to the latest version of the Affinity application for macOS.

Timeline

• Sep 17 2026 – Findings reported to Canva
• Sep 22 2026 – Vulnerability triaged by Canva and accepted
• Oct 8 2026 – Fix released

Acknowledgements

This vulnerability was submitted to Canva by Xusheng Li.

CVE-2026-96396

CVE: CVE-2026-96396
Severity: Medium
CVSS: 4.9 – CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected Products and Versions

• Affinity by Canva app for macOS before 3.3.1

Details

The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could corrupt heap memory and cause the thumbnail or preview extension to crash.

Remediation Advice

Canva recommends users upgrade to the latest version of the Affinity application for macOS.

Timeline

• Sep 17 2026 – Findings reported to Canva
• Sep 22 2026 – Vulnerability triaged by Canva and accepted
• Oct 8 2026 – Fix released

Acknowledgements

This vulnerability was submitted to Canva by Xusheng Li.

CVE-2026-103220

CVE: CVE-2026-103220
Severity: Medium
CVSS: 4.5 – CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

Affected Products and Versions

• Affinity by Canva app before 3.3.1

Details

The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and the dereference of an untrusted pointer. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in memory corruption or an application crash.

Remediation Advice

Canva recommends users upgrade to the latest version of the Affinity application for their platform.

Timeline

• Sep 17 2026 – Findings reported to Canva
• Sep 23 2026 – Vulnerability triaged by Canva and accepted
• Oct 8 2026 – Fix released

Acknowledgements

This vulnerability was submitted to Canva by Xusheng Li.

CVE-2026-101130

CVE: CVE-2026-101130
Severity: Low
CVSS: 3.6 – CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L

Affected Products and Versions

• Affinity by Canva app before 3.3.1

Details

The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.

Remediation Advice

Canva recommends users upgrade to the latest version of the Affinity application for their platform.

Timeline

• Sep 17 2026 – Findings reported to Canva
• Sep 28 2026 – Vulnerability triaged by Canva and accepted
• Oct 8 2026 – Fix released

Acknowledgements

This vulnerability was submitted to Canva by Xusheng Li.

CVE-2026-101094

CVE: CVE-2026-101094
Severity: Low
CVSS: 3.6 – CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L

Affected Products and Versions

• Affinity by Canva app before 3.3.1

Details

The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.

Remediation Advice

Canva recommends users upgrade to the latest version of the Affinity application for their platform.

Timeline

• Sep 17 2026 – Findings reported to Canva
• Sep 28 2026 – Vulnerability triaged by Canva and accepted
• Oct 8 2026 – Fix released

Acknowledgements

This vulnerability was submitted to Canva by Xusheng Li.