In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing XE files. This vulnerability could lead to a heap-based buffer overflow, allowing an attacker to execute arbitrary code in the context of the current process.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.4 | CVE-2025-52584 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the affected application and provide specially crafted XE files that can trigger the heap-based buffer overflow. This could allow the attacker to execute arbitrary code with the privileges of the current user.
Affected Products
- Cobalt: A design software that may be affected by the vulnerability.
- Xenon: Another design application with similar vulnerabilities.
- Argon: Affected by the same lack of validation in XE file parsing.
- Lithium: Also vulnerable to the heap-based buffer overflow.
- Cobalt Share: The sharing feature of Cobalt that is impacted.
Mitigation
To mitigate this vulnerability, users should upgrade to Ashlar-Vellum versions 12.6.1204.204 or later, which include fixes for the improper validation of user-supplied data when parsing XE files.