CVE-2025-65087: Ashlar-Vellum CAD Products Out-of-Bounds Read in VC6 Parsing

CVE-2025-65087 · Severity: info · CVSS 8.4 · Published 2026-05-12

Ashlar-Vellum CAD software products, used in critical manufacturing for 3D modeling and design, are affected by a security flaw in how they handle specific file types. An attacker could trick a user into opening a malicious VC6 file, potentially leading to the theft of sensitive design data or the ability to run unauthorized code on the user's computer. This could result in a loss of intellectual property or a full system compromise within a manufacturing environment.

Quick answers

Is CVE-2025-65087 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-65087 being exploited in the wild.
How severe is CVE-2025-65087?
Informational severity, with a CVSS score of 8.4, published 12 May 2026.
Which products and versions are affected?
Ashlar-Vellum Cobalt <= 12.6.1204.216; Ashlar-Vellum Xenon <= 12.6.1204.216; Ashlar-Vellum Argon <= 12.6.1204.216; Ashlar-Vellum Lithium <= 12.6.1204.216; and 1 more.
Is there a fix for CVE-2025-65087?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-65087 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2025-65087?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability (CWE-125) exists in multiple Ashlar-Vellum products, including Cobalt, Xenon, Argon, Lithium, and Cobalt Share. The flaw is triggered during the parsing of specially crafted VC6 files. While the primary vulnerability is an out-of-bounds read, the advisory indicates it can be leveraged for both information disclosure and arbitrary code execution. Exploitation requires a local user to open a malicious file (user interaction required). The vendor has released build 12.6.1204.217 to mitigate this issue.

Affected products

  • Ashlar-Vellum Cobalt <= 12.6.1204.216
  • Ashlar-Vellum Xenon <= 12.6.1204.216
  • Ashlar-Vellum Argon <= 12.6.1204.216
  • Ashlar-Vellum Lithium <= 12.6.1204.216
  • Ashlar-Vellum Cobalt Share <= 12.6.1204.216

Timeline

  • 2026-05-12: advisory: CISA ICSA-25-329-01 published
  • 2026-05-12: disclosed: CVE-2025-65087 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.