In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing CO files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.4 | CVE-2025-53705 |
Exploitation
To exploit this vulnerability, an attacker must have local access to the affected application and provide specially crafted CO files that can trigger the out-of-bounds write. This could allow the attacker to execute arbitrary code within the context of the application, potentially leading to a complete system compromise.
Affected Products
- Cobalt: A design software that may be affected by the vulnerability.
- Xenon: Another design application that lacks proper data validation.
- Argon: Affected by the same vulnerability as the other products.
- Lithium: Vulnerable to exploitation due to improper user data handling.
- Cobalt Share: The sharing platform for Cobalt that is also impacted.
Mitigation
To mitigate this vulnerability, users should upgrade to Ashlar-Vellum versions 12.6.1204.204 or later, where the issue has been addressed. Additionally, users should ensure that they validate and sanitize all user-supplied data before processing it within the application.