In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing CO files. This could lead to an out-of-bounds write, allowing an attacker to execute arbitrary code in the context of the current process. The vulnerability poses significant risks due to its high severity rating.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.4 | CVE-2025-53705 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the affected application and provide specially crafted CO files that can trigger the out-of-bounds write. This could allow the attacker to execute arbitrary code, potentially leading to a complete compromise of the application and the system it runs on.
Affected Products
- Cobalt: Affected version prior to 12.6.1204.204 lacks proper data validation.
- Xenon: Similar vulnerabilities as Cobalt, leading to potential code execution.
- Argon: Vulnerable to out-of-bounds write issues in earlier versions.
- Lithium: Affected by the same lack of validation in CO file parsing.
- Cobalt Share: Also vulnerable, allowing for arbitrary code execution.
Mitigation
To mitigate this vulnerability, users should upgrade to Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.204 or later. Additionally, implementing strict input validation and monitoring for unusual activity can help reduce the risk of exploitation.