In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the applications lack proper validation of user-supplied data when parsing VC6 files. This vulnerability could lead to a heap-based buffer overflow, allowing an attacker to execute arbitrary code in the context of the current process.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.4 | CVE-2025-46269 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the affected applications and provide specially crafted VC6 files that can trigger the heap-based buffer overflow, potentially leading to arbitrary code execution.
Affected Products
- Cobalt: A design software that may be affected by the vulnerability.
- Xenon: Another design application with similar vulnerabilities.
- Argon: Affected by the same lack of validation in VC6 file parsing.
- Lithium: Also vulnerable to the heap-based buffer overflow issue.
- Cobalt Share: The sharing platform for Cobalt that is impacted.
Mitigation
To mitigate this vulnerability, users should upgrade to Ashlar-Vellum versions 12.6.1204.204 or later, which include the necessary validation fixes for VC6 file parsing.