# CVE-2025-65087: Ashlar-Vellum CAD Products Out-of-Bounds Read in VC6 Parsing

Source: https://junglewise.ai/threats/cve-2025-65087-ashlar-vellum-cad-products-out-of-bounds-read-in-vc6-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2025-65087 · Severity: info · CVSS 8.4 · Published 2026-05-12

Ashlar-Vellum CAD software products, used in critical manufacturing for 3D modeling and design, are affected by a security flaw in how they handle specific file types. An attacker could trick a user into opening a malicious VC6 file, potentially leading to the theft of sensitive design data or the ability to run unauthorized code on the user's computer. This could result in a loss of intellectual property or a full system compromise within a manufacturing environment.

## Quick answers

**Is CVE-2025-65087 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-65087 being exploited in the wild.

**How severe is CVE-2025-65087?** Informational severity, with a CVSS score of 8.4, published 12 May 2026.

**Which products and versions are affected?** Ashlar-Vellum Cobalt <= 12.6.1204.216; Ashlar-Vellum Xenon <= 12.6.1204.216; Ashlar-Vellum Argon <= 12.6.1204.216; Ashlar-Vellum Lithium <= 12.6.1204.216; and 1 more.

**Is there a fix for CVE-2025-65087?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-65087 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2025-65087?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability (CWE-125) exists in multiple Ashlar-Vellum products, including Cobalt, Xenon, Argon, Lithium, and Cobalt Share. The flaw is triggered during the parsing of specially crafted VC6 files. While the primary vulnerability is an out-of-bounds read, the advisory indicates it can be leveraged for both information disclosure and arbitrary code execution. Exploitation requires a local user to open a malicious file (user interaction required). The vendor has released build 12.6.1204.217 to mitigate this issue.

## Affected products

- Ashlar-Vellum Cobalt <= 12.6.1204.216
- Ashlar-Vellum Xenon <= 12.6.1204.216
- Ashlar-Vellum Argon <= 12.6.1204.216
- Ashlar-Vellum Lithium <= 12.6.1204.216
- Ashlar-Vellum Cobalt Share <= 12.6.1204.216

## Timeline

- 2026-05-12: advisory: CISA ICSA-25-329-01 published
- 2026-05-12: disclosed: CVE-2025-65087 published to NVD

## References

- [https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-01](https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-01)