EUVD-2025-209808
GHSA-fvp9-5vqp-3v7m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious VC6 file
-
DeliveryDeliver to target user (email/share)
-
ExploitUser opens file in Ashlar-Vellum app
-
ExecutionOut-of-bounds read in VC6 parser
-
ImpactMemory disclosure or code execution as user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open or import a specially crafted VC6 file in a vulnerable Ashlar-Vellum product (Cobalt, Xenon, Argon, Lithium, or Cobalt Share ≤12.6.1204.216); the trigger is the file-parsing routine for the VC6 format. Limiting factors: the CVSS 4.0 vector is AV:L with UI:A (Active), meaning the attack is local and cannot succeed without the user actively opening the malicious file - there is no remote, unauthenticated, or automatic-exploitation path. No elevated privileges are needed (PR:N) and no special product configuration is required beyond having the affected software installed, but the dependence on user interaction and local file delivery substantially narrows realistic exploitation to targeted social-engineering delivery. |
| Impact | Signals are internally consistent and point to a genuine but not urgent priority. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:A) shows a local vector requiring active user interaction - the victim must open an attacker-supplied VC6 file - which sharply limits mass exploitation, and CISA's SSVC decision agrees: Exploitation 'none', Automatable 'no', Technical Impact 'total'. The 'total' technical impact aligns with VC:H/VI:H/VA:H (full compromise of the vulnerable system) and the 8.4 base score. EPSS is 0.01% (0th percentile) and there is no KEV listing and no known POC, so real-world exploitation probability is currently very low. There is no conflict among the sources: this is a high-severity-but-low-immediate-likelihood client-side file-parsing bug - dangerous if a targeted user is phished into opening a file, but not a wormable or internet-facing threat. Treat as a standard-priority patch for organizations that actually run Ashlar-Vellum software. |
| Exploit ScenarioDerived | An attacker crafts a malicious VC6 CAD file and delivers it to an engineer via email, a shared project repository, or a supplier data exchange, relying on the fact that opening customer/partner design files is routine. When the engineer opens the file in Cobalt (or Xenon/Argon/Lithium/Cobalt Share), the parser performs an out-of-bounds read that the attacker leverages to disclose process memory or execute code with the user's privileges. No public exploit is known, so a functional attack would require the adversary to develop their own exploit for the parsing flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Arbitrary code execution and information disclosure in the Ashlar-Vellum CAD/3D-modeling suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.1204.216 and prior) can be triggered when the application parses a maliciously crafted VC6 file. The flaw is an out-of-bounds read (CWE-125) reached through the file-import path, giving an attacker who convinces a user to open a booby-trapped file the ability to leak memory or run code in the context of the victim. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), consistent with the local, user-interaction-dependent attack model reported by CISA ICS-CERT.
RemediationAI
Consult CISA advisory ICSA-25-329-01 (https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-01) for the vendor's fixed release and upgrade all instances of Cobalt, Xenon, Argon, Lithium, and Cobalt Share beyond 12.6.1204.216; no vendor-released patched version number is independently confirmed in the available data, so verify the exact fixed build directly with Ashlar-Vellum before deploying. Because exploitation requires a user to open a malicious VC6 file, the most effective compensating control until patched is to refuse to open VC6 (and other Ashlar-Vellum) files from untrusted or unverified sources and to treat such files like any other executable attachment - block or quarantine them at the email/file gateway (trade-off: legitimate design files from external partners will be delayed pending validation). Additionally, run the CAD applications under least-privileged user accounts and consider application-level sandboxing or opening suspect files only on an isolated, non-networked workstation, accepting the reduced convenience of segregated file handling.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected products are Ashlar-Vellum's family of mechanical CAD and 3D drafting/modeling tools that share a common file-handling engine. The vulnerability lives in the parser that ingests VC6-format files: CWE-125 (Out-of-Bounds Read) means the parser reads memory outside the bounds of an allocated buffer, typically because a length/offset/index field embedded in the file is trusted without validation against the actual buffer size. An out-of-bounds read primarily discloses adjacent process memory, but the ICS-CERT advisory and CVSS both rate integrity and availability impact as High, indicating the malformed-parse condition can be driven into memory corruption sufficient for code execution, not merely a read. The CPE set (ashlar-vellum:cobalt, :xenon, :argon, :lithium, :cobalt_share) confirms the shared vulnerable code path spans all five products.
Know when Cobalt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
File-parsing flaw requiring the user to open a crafted local file (AV:L, UI:R), no prior privileges (PR:N), yielding full compromise of the process (C/I/A:H).
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
2DescriptionCVE.org
An Out-of-Bounds Read vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code when a specially crafted VC6 file is being parsed.
Executive ViewAI
The Ashlar-Vellum CAD/3D-modeling suite (versions 12.6.1204.216 and earlier) contains an out-of-bounds read vulnerability enabling arbitrary code execution or sensitive memory disclosure when users open a malicious VC6 file. Although no public exploit identified at time of analysis, the critical nature of design workflows makes affected systems attractive targets for supply chain compromise and intellectual property theft. With no vendor patch currently available, this vulnerability presents a material risk requiring immediate mitigation.
No vendor-released patch identified at time of analysis. Interim mitigations include: restricting VC6 file imports from external and untrusted sources, network segmentation to isolate design workstations from sensitive systems, endpoint detection and response (EDR) to detect suspicious execution patterns, mandatory user training on file handling practices, and regular backups to enable recovery from potential compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
An Out-of-Bounds Write vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share version
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of
A Heap-based Buffer Overflow vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of
Arbitrary code execution and information disclosure in Ashlar-Vellum's CAD suite (Cobalt, Xenon, Argon, Lithium, and Cob
Arbitrary code execution in the Ashlar-Vellum CAD suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.
Parsing a maliciously crafted CO design file in Ashlar-Vellum Cobalt 12.2.1204.97 (the version identified in the CPE dat
Heap-based buffer overflow in Ashlar-Vellum Cobalt 12.2.1204.97 allows attackers to execute arbitrary code when a user o
Integer overflow in the XE file-parsing routine of Ashlar-Vellum Cobalt 12.2.1204.97 lets an attacker execute arbitrary
Heap-based buffer overflow in Ashlar-Vellum Cobalt during parsing of VS drawing files allows an attacker to execute arbi
Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7
Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS
Exploit-DB