In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing AR files. This could lead to an out-of-bounds read, allowing an attacker to execute arbitrary code in the context of the current process.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.4 | CVE-2025-41392 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the affected applications and provide specially crafted AR files that can trigger the out-of-bounds read, potentially leading to arbitrary code execution.
Affected Products
- Ashlar-Vellum Cobalt: A design software that lacks proper validation of user input.
- Ashlar-Vellum Xenon: Affected by the same vulnerability as Cobalt.
- Ashlar-Vellum Argon: Vulnerable due to improper data handling.
- Ashlar-Vellum Lithium: Also susceptible to the out-of-bounds read issue.
- Ashlar-Vellum Cobalt Share: Shares the same security flaw as the other products.
Mitigation
Users are advised to update to Ashlar-Vellum versions 12.6.1204.204 or later to mitigate this vulnerability. Regularly applying security updates and patches can help protect against similar vulnerabilities in the future.