CVE-2018-3973: An exploitable out of bounds write exists in the CAL parsing functionality of Canvas Draw version 5.0.0.

Security readout for executives and security teams

Canvas Draw 5.0.0 can be compromised when a user processes a malicious image file. The flaw may let an attacker run code on the affected workstation, so exposure is mainly where this legacy design software handles files from email, downloads, clients, or partners. Likely exposed assets are user workstations with Canvas Draw 5.0.0 installed, especially users who open externally supplied CAL or PCX image files. The source bundle does not identify other affected versions or products. Prioritize remediation for teams that receive external design or image files. This is high impact but not currently evidenced as actively exploited in the supplied sources, so urgency depends on real workstation exposure and file-handling workflows. Mitigation focus: Inventory systems for Canvas Draw 5.0.0 installations.; Check ACD Systems or Talos guidance for fixed versions or vendor remediation.; Restrict opening untrusted CAL or PCX files in Canvas Draw..

Prepared

May 23, 2026, 08:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.