EUVD-2025-209807
GHSA-2fv4-66cr-954x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious VC6 file
-
DeliveryDeliver to CAD user via email/share
-
ExploitUser opens file in Ashlar-Vellum app
-
ExecutionTrigger out-of-bounds read in VC6 parser
-
PersistLeak memory or corrupt execution state
-
ImpactExecute arbitrary code as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a user of Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, or Cobalt Share (version 12.6.1204.216 or earlier) to open or parse a specially crafted VC6 file - the malicious VC6 file being loaded by the application IS the trigger condition. The CVSS vector confirms local attack vector (AV:L) with required active user interaction (UI:A) and no privileges (PR:N), meaning no authentication is needed but the attack cannot succeed without the victim opening the file. Limiting factors: it is not remotely or automatically exploitable (SSVC Automatable: no), the target must have one of the named products installed, the specific VC6 file format must be processed, and success depends on the victim's willingness to open an untrusted file, which is why it is well-suited to targeted rather than mass exploitation. |
| Impact | The signals point to a genuinely severe technical impact but a low likelihood of opportunistic, at-scale exploitation. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A, VC:H/VI:H/VA:H, base 8.4) shows that no privileges are required but user interaction is - the victim must open a malicious VC6 file - and the attack vector is local/file-based rather than network-reachable. This is corroborated by CISA SSVC: Exploitation 'none' (no observed or public exploitation), Automatable 'no' (cannot be sprayed en masse because it needs a user to open a file), and Technical Impact 'total' (full compromise of the affected component if it triggers). EPSS is 0.01% (0th percentile), and there is no KEV listing and no POC, all consistent with a not-yet-exploited, hard-to-mass-exploit client-side bug. Net: real priority for organizations that actually run this CAD software and handle externally-sourced drawing files, but not an emergency-patch, worm-scale issue. Note one consistency caveat: PR:N in the vector means no authentication, yet exploitation still hinges entirely on user interaction (UI:A), so 'unauthenticated' should not be read as 'unattended remote.' |
| Exploit ScenarioDerived | An attacker crafts a malicious VC6 file with manipulated size/offset fields and delivers it to an engineer via email, a shared project folder, or a supplier file exchange, relying on social engineering to get it opened in Cobalt, Xenon, Argon, Lithium, or Cobalt Share. When the application parses the file, the out-of-bounds read leaks process memory and/or corrupts state to achieve arbitrary code execution in the user's context. No public POC is identified at time of analysis, and the attack requires local user interaction rather than remote automation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Arbitrary code execution and information disclosure in Ashlar-Vellum's CAD suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.1204.216 and prior) is possible when the application parses a specially crafted VC6 file, driven by an out-of-bounds read (CWE-125). An attacker who convinces a user to open a malicious VC6 file can read out-of-bounds memory to leak data or steer execution toward running arbitrary code in the context of the user. There is no public exploit identified at time of analysis, the EPSS score is negligible (0.01%), and CISA's SSVC framework rates exploitation as 'none' but technical impact as 'total'.
RemediationAI
No vendor-released patch version is identified in the available data, so consult CISA ICS advisory ICSA-25-329-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-01) for the vendor's fixed build and upgrade to it once published; do not assume a version number that is not stated. As compensating controls until a confirmed patch is applied: treat VC6 files as untrusted and do not open VC6 (or other Ashlar-Vellum drawing) files received by email, download, or from third parties - this is the single most effective mitigation since exploitation requires opening a crafted file, with the trade-off of disrupting legitimate file exchange with outside parties; validate the provenance of drawing files and open suspect files only in an isolated/sandboxed or offline VM to contain any code execution, at the cost of workflow friction; and restrict which users run these CAD applications and apply least-privilege so a successful exploit executes with reduced rights. Since the flaw is a file-parsing bug, network-level controls (firewall/port blocks) provide little protection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected products are Ashlar-Vellum's Windows-based mechanical/precision CAD and 3D modeling tools (Cobalt, Xenon, Argon, Lithium, and the Cobalt Share companion), identified in the CPE data as cpe:2.3:a:ashlar-vellum:{cobalt,xenon,argon,lithium,cobalt_share}. The vulnerability is a CWE-125 Out-of-Bounds Read in the parser that ingests VC6 files (an Ashlar-Vellum drawing/exchange format). Out-of-bounds reads occur when the parser trusts attacker-controlled length, offset, or index fields in the file and reads past the bounds of an allocated buffer; the leaked memory can disclose sensitive process data, and when the corrupted read feeds control-flow or pointer logic it can be leveraged toward memory corruption and code execution, which is why the advisory pairs 'disclose information' with 'execute arbitrary code'.
Know when Cobalt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local file-parsing bug requiring the victim to open a crafted VC6 file, so AV:L and UI:R; no privileges needed (PR:N) and OOB read enabling code execution yields high C/I/A.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
An Out-of-Bounds Read vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code when a specially crafted VC6 file is being parsed.
Executive ViewAI
Ashlar-Vellum's CAD suite (Cobalt, Xenon, Argon, Lithium, Cobalt Share versions 12.6.1204.216 and prior) is vulnerable to arbitrary code execution and sensitive data theft via specially crafted VC6 files. Organizations risk loss of valuable engineering designs and system compromise if users are socially engineered to open malicious files. Although no active public exploitation has been observed, the vulnerability's high severity and potential access to intellectual property warrant immediate preventive controls.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict VC6 file handling through email gateways and file execution policies; disable VC6 file associations at the operating system level if operationally acceptable; isolate affected systems on network segments with restricted lateral traffic to contain potential compromise; implement robust monitoring and alerting on Ashlar-Vellum process execution, outbound network connections, and suspicious system activities; require users to open VC6 files only from verified internal sources and route external VC6 files through isolated sandboxing or analysis environments before execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
An Out-of-Bounds Write vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share version
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of
A Heap-based Buffer Overflow vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of
Arbitrary code execution and information disclosure in the Ashlar-Vellum CAD/3D-modeling suite (Cobalt, Xenon, Argon, Li
Arbitrary code execution in the Ashlar-Vellum CAD suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.
Parsing a maliciously crafted CO design file in Ashlar-Vellum Cobalt 12.2.1204.97 (the version identified in the CPE dat
Heap-based buffer overflow in Ashlar-Vellum Cobalt 12.2.1204.97 allows attackers to execute arbitrary code when a user o
Integer overflow in the XE file-parsing routine of Ashlar-Vellum Cobalt 12.2.1204.97 lets an attacker execute arbitrary
Heap-based buffer overflow in Ashlar-Vellum Cobalt during parsing of VS drawing files allows an attacker to execute arbi
Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7
Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS
Exploit-DB