In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing AR files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.4 | CVE-2025-41392 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the affected application and provide specially crafted AR files that can trigger the out-of-bounds read, potentially allowing arbitrary code execution within the context of the application.
Affected Products
- Cobalt: A design software that may be affected by the vulnerability.
- Xenon: Another design application that lacks proper validation.
- Argon: Affected by the same vulnerability as the other products.
- Lithium: Vulnerable due to improper data handling.
- Cobalt Share: The sharing feature of Cobalt is also impacted.
Mitigation
Users are advised to update to Ashlar-Vellum versions 12.6.1204.204 or later to mitigate this vulnerability. Regularly applying updates and patches can help protect against similar vulnerabilities in the future.