EUVD-2025-209805
GHSA-c3x5-fm9m-c4fc
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitation requires opening a local malicious file (AV:L, UI:R) with no prior privileges (PR:N); a successful parse yields full code execution, so C/I/A all High.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
An Out-of-Bounds Write vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to execute arbitrary code when a specially crafted VC6 file is being parsed.
AnalysisAI
Arbitrary code execution in the Ashlar-Vellum CAD suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.1204.216 and prior) occurs when the application parses a maliciously crafted VC6 file, triggering an out-of-bounds write. An attacker must convince a user to open a booby-trapped drawing file, after which code runs in the context of the victim's user account. There is no public exploit identified at time of analysis, and the EPSS probability is negligible (0.01%), consistent with the CISA/ICS-CERT SSVC assessment of no known exploitation.
Technical ContextAI
The affected products are commercial 2D/3D mechanical CAD and drafting applications from Ashlar-Vellum that share a common file-handling engine. The flaw is CWE-787 (Out-of-Bounds Write): the VC6 file parser fails to validate structure sizes or offsets read from the file, allowing attacker-controlled data to be written beyond the bounds of an allocated buffer. This class of memory corruption can overwrite adjacent heap or stack structures and, when combined with controllable data, be steered into arbitrary code execution. The shared CPE set (cpe:2.3:a:ashlar-vellum:cobalt, :xenon, :argon, :lithium, :cobalt_share) indicates the vulnerable parsing code is common across the product line rather than unique to one application.
RemediationAI
No vendor-released patch version is identified in the available data at time of analysis; consult the CISA ICS advisory (https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-01) for the vendor's current fixed release and upgrade to any version above 12.6.1204.216 once published. Because exploitation requires opening a crafted VC6 file, the primary compensating control is to restrict handling of untrusted files: do not open VC6 files received via email, downloads, or untrusted sources, and validate the provenance of any shared drawing files (trade-off: adds friction to legitimate file exchange with partners). Where feasible, run the CAD applications under a least-privileged user account on segmented workstations so a successful exploit is contained to that user's context rather than an administrative or domain-connected identity (trade-off: some CAD deployments assume elevated rights for licensing or plugins). Application allow-listing and up-to-date endpoint protection provide additional detection of post-exploitation payloads.
An Out-of-Bounds Write vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share version
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of
A Heap-based Buffer Overflow vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of
Arbitrary code execution and information disclosure in the Ashlar-Vellum CAD/3D-modeling suite (Cobalt, Xenon, Argon, Li
Arbitrary code execution and information disclosure in Ashlar-Vellum's CAD suite (Cobalt, Xenon, Argon, Lithium, and Cob
Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8),
Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS
Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8),
Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS
Ashlar-Vellum Cobalt AR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. Rated high severit
Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today