Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.4

Ashlar-Vellum Cobalt and other software versions lack file validation

CVE-2025-53705 · published 1 year ago
Summary

If an attacker sends a manipulated file, they could potentially run malicious code on your computer. This affects Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share, and you should update to version 12.6.1204.204 or later to fix the issue.

What to do
  • Update ashlar argon to version 12.2.1204.204 or later.
  • Update ashlar cobalt to version 12.2.1204.204 or later.
  • Update ashlar cobalt_share to version 12.2.1204.204 or later.
  • Update ashlar lithium to version 12.2.1204.204 or later.
  • Update ashlar xenon to version 12.2.1204.204 or later.
Affected software
VendorProductAffected versions
ashlar argon < 12.2.1204.204
cpe:2.3:a:ashlar:argon:*:*:*:*:*:*:*:*
ashlar cobalt < 12.2.1204.204
cpe:2.3:a:ashlar:cobalt:*:*:*:*:*:*:*:*
ashlar cobalt_share < 12.2.1204.204
cpe:2.3:a:ashlar:cobalt_share:*:*:*:*:*:*:*:*
ashlar lithium < 12.2.1204.204
cpe:2.3:a:ashlar:lithium:*:*:*:*:*:*:*:*
ashlar xenon < 12.2.1204.204
cpe:2.3:a:ashlar:xenon:*:*:*:*:*:*:*:*
Original advisory text
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing CO files. This ...
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing CO files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published18 Aug 2025
Updated26 Oct 2026
First seen7 Mar 2026
Sources
CVE-2025-53705 · NVD
Track software like this
Free during beta