EUVD-2025-209808
GHSA-fvp9-5vqp-3v7m
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
File-parsing flaw requiring the user to open a crafted local file (AV:L, UI:R), no prior privileges (PR:N), yielding full compromise of the process (C/I/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
An Out-of-Bounds Read vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code when a specially crafted VC6 file is being parsed.
AnalysisAI
Arbitrary code execution and information disclosure in the Ashlar-Vellum CAD/3D-modeling suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.1204.216 and prior) can be triggered when the application parses a maliciously crafted VC6 file. The flaw is an out-of-bounds read (CWE-125) reached through the file-import path, giving an attacker who convinces a user to open a booby-trapped file the ability to leak memory or run code in the context of the victim. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), consistent with the local, user-interaction-dependent attack model reported by CISA ICS-CERT.
Technical ContextAI
The affected products are Ashlar-Vellum's family of mechanical CAD and 3D drafting/modeling tools that share a common file-handling engine. The vulnerability lives in the parser that ingests VC6-format files: CWE-125 (Out-of-Bounds Read) means the parser reads memory outside the bounds of an allocated buffer, typically because a length/offset/index field embedded in the file is trusted without validation against the actual buffer size. An out-of-bounds read primarily discloses adjacent process memory, but the ICS-CERT advisory and CVSS both rate integrity and availability impact as High, indicating the malformed-parse condition can be driven into memory corruption sufficient for code execution, not merely a read. The CPE set (ashlar-vellum:cobalt, :xenon, :argon, :lithium, :cobalt_share) confirms the shared vulnerable code path spans all five products.
RemediationAI
Consult CISA advisory ICSA-25-329-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-01) for the vendor's fixed release and upgrade all instances of Cobalt, Xenon, Argon, Lithium, and Cobalt Share beyond 12.6.1204.216; no vendor-released patched version number is independently confirmed in the available data, so verify the exact fixed build directly with Ashlar-Vellum before deploying. Because exploitation requires a user to open a malicious VC6 file, the most effective compensating control until patched is to refuse to open VC6 (and other Ashlar-Vellum) files from untrusted or unverified sources and to treat such files like any other executable attachment - block or quarantine them at the email/file gateway (trade-off: legitimate design files from external partners will be delayed pending validation). Additionally, run the CAD applications under least-privileged user accounts and consider application-level sandboxing or opening suspect files only on an isolated, non-networked workstation, accepting the reduced convenience of segregated file handling.
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of
Arbitrary code execution and information disclosure in Ashlar-Vellum's CAD suite (Cobalt, Xenon, Argon, Lithium, and Cob
Arbitrary code execution in the Ashlar-Vellum CAD suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.
Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8),
Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS
Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8),
Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS
Ashlar-Vellum Cobalt AR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. Rated high severit
Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack
Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7
Same weakness CWE-125 – Out-of-bounds Read
View allShare
External POC / Exploit Code
Leaving vuln.today