In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing XE files. This vulnerability could lead to a heap-based buffer overflow, allowing an attacker to execute arbitrary code in the context of the current process.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.4 | CVE-2025-52584 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the affected application and provide specially crafted XE files that can trigger the heap-based buffer overflow. This could allow the attacker to execute arbitrary code with the privileges of the current user.
Affected Products
- Cobalt: A design software that may be affected by the vulnerability.
- Xenon: Another design application that lacks proper validation.
- Argon: Affected by the same vulnerability as the other products.
- Lithium: Vulnerable to exploitation through XE file parsing.
- Cobalt Share: The sharing feature of Cobalt that is also impacted.
Mitigation
To mitigate this vulnerability, users should upgrade to Ashlar-Vellum versions 12.6.1204.204 or later, which include fixes for the improper validation of user-supplied data when parsing XE files.