In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing XE files. This could lead to a heap-based buffer overflow. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.4 | CVE-2025-52584 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the affected application and provide specially crafted XE files that can trigger the heap-based buffer overflow. This could allow the attacker to execute arbitrary code within the context of the application, potentially leading to unauthorized actions or data exposure.
Affected Products
- Cobalt: Affected version prior to 12.6.1204.204 lacks validation of XE files.
- Xenon: Similar vulnerabilities as Cobalt, leading to potential code execution.
- Argon: Vulnerable to heap-based buffer overflow when processing XE files.
- Lithium: Also affected by the same lack of data validation.
- Cobalt Share: Shares the same vulnerabilities as the other products listed.
Mitigation
To mitigate this vulnerability, users should upgrade to Ashlar-Vellum versions 12.6.1204.204 or later, which include the necessary validation checks for user-supplied data when parsing XE files. Additionally, restricting local access to the application can help reduce the risk of exploitation.