EUVD-2025-209807
GHSA-2fv4-66cr-954x
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file-parsing bug requiring the victim to open a crafted VC6 file, so AV:L and UI:R; no privileges needed (PR:N) and OOB read enabling code execution yields high C/I/A.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
An Out-of-Bounds Read vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code when a specially crafted VC6 file is being parsed.
AnalysisAI
Arbitrary code execution and information disclosure in Ashlar-Vellum's CAD suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.1204.216 and prior) is possible when the application parses a specially crafted VC6 file, driven by an out-of-bounds read (CWE-125). An attacker who convinces a user to open a malicious VC6 file can read out-of-bounds memory to leak data or steer execution toward running arbitrary code in the context of the user. There is no public exploit identified at time of analysis, the EPSS score is negligible (0.01%), and CISA's SSVC framework rates exploitation as 'none' but technical impact as 'total'.
Technical ContextAI
The affected products are Ashlar-Vellum's Windows-based mechanical/precision CAD and 3D modeling tools (Cobalt, Xenon, Argon, Lithium, and the Cobalt Share companion), identified in the CPE data as cpe:2.3:a:ashlar-vellum:{cobalt,xenon,argon,lithium,cobalt_share}. The vulnerability is a CWE-125 Out-of-Bounds Read in the parser that ingests VC6 files (an Ashlar-Vellum drawing/exchange format). Out-of-bounds reads occur when the parser trusts attacker-controlled length, offset, or index fields in the file and reads past the bounds of an allocated buffer; the leaked memory can disclose sensitive process data, and when the corrupted read feeds control-flow or pointer logic it can be leveraged toward memory corruption and code execution, which is why the advisory pairs 'disclose information' with 'execute arbitrary code'.
RemediationAI
No vendor-released patch version is identified in the available data, so consult CISA ICS advisory ICSA-25-329-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-01) for the vendor's fixed build and upgrade to it once published; do not assume a version number that is not stated. As compensating controls until a confirmed patch is applied: treat VC6 files as untrusted and do not open VC6 (or other Ashlar-Vellum drawing) files received by email, download, or from third parties - this is the single most effective mitigation since exploitation requires opening a crafted file, with the trade-off of disrupting legitimate file exchange with outside parties; validate the provenance of drawing files and open suspect files only in an isolated/sandboxed or offline VM to contain any code execution, at the cost of workflow friction; and restrict which users run these CAD applications and apply least-privilege so a successful exploit executes with reduced rights. Since the flaw is a file-parsing bug, network-level controls (firewall/port blocks) provide little protection.
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of
Arbitrary code execution and information disclosure in the Ashlar-Vellum CAD/3D-modeling suite (Cobalt, Xenon, Argon, Li
Arbitrary code execution in the Ashlar-Vellum CAD suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.
Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8),
Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS
Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8),
Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS
Ashlar-Vellum Cobalt AR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. Rated high severit
Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack
Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7
Same weakness CWE-125 – Out-of-bounds Read
View allShare
External POC / Exploit Code
Leaving vuln.today