CVE-2018-3976: An exploitable out-of-bounds write exists in the CALS Raster file format-parsing functionality of Canvas Dr...

Security readout for executives and security teams

Canvas Draw 5.0.0.28 can be compromised if a user opens a malicious CAL image. The flaw can let an attacker run code on the affected workstation. Business urgency depends on whether this legacy version is installed and used to handle CAL/CALS raster files. Exposure is most likely on endpoints or design workflows running ACDSystems Canvas Draw 5.0.0.28 and opening CAL/CALS images from email, web downloads, shared drives, or customer submissions. Prioritize remediation where Canvas Draw 5.0.0.28 is installed or where users handle external image files. This is high impact but likely narrow in scope unless the product is deployed broadly. Mitigation focus: Inventory Canvas Draw installations and identify version 5.0.0.28.; Check ACD Systems or Talos guidance for fixed or supported versions.; Prevent users from opening untrusted CAL/CALS image files..

Prepared

May 23, 2026, 08:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.