CVE-2025-65085
📋 TL;DR
A heap-based buffer overflow vulnerability in Ashlar-Vellum CAD software allows attackers to read sensitive memory or execute arbitrary code by sending specially crafted data. This affects users of Cobalt, Xenon, Argon, Lithium, and Cobalt Share products. The high CVSS score indicates critical severity requiring immediate attention.
💻 Affected Systems
- Ashlar-Vellum Cobalt
- Ashlar-Vellum Xenon
- Ashlar-Vellum Argon
- Ashlar-Vellum Lithium
- Ashlar-Vellum Cobalt Share
📦 What is this software?
Argon by Ashlar
Cobalt by Ashlar
Lithium by Ashlar
Xenon by Ashlar
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution leading to data theft, ransomware deployment, or lateral movement across networks.
Likely Case
Information disclosure of sensitive memory contents or application crashes causing denial of service.
If Mitigated
Limited impact with proper network segmentation and exploit prevention controls in place.
🎯 Exploit Status
Heap buffer overflows with CWE-122 typically have low exploitation complexity when proof-of-concepts become available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 12.6.1205 or later
Vendor Advisory: https://www.ashlar.com/security-advisory
Restart Required: Yes
Instructions:
1. Download latest version from Ashlar-Vellum support portal
2. Backup current installation and data
3. Run installer with administrative privileges
4. Restart system after installation completes
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected systems from untrusted networks and internet access
Application Whitelisting
windowsRestrict execution of Ashlar-Vellum processes to authorized users only
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Deploy endpoint protection with exploit prevention capabilities
🔍 How to Verify
Check if Vulnerable:
Check Help > About in Ashlar-Vellum application for version numberCheck Version:
Not applicable - check via application GUIVerify Fix Applied:
Verify version is 12.6.1205 or higher in Help > About📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory access violations
- Unusual process creation from Ashlar-Vellum executables
Network Indicators:
- Unexpected network connections from CAD software
- Malformed data packets to Ashlar-Vellum services
SIEM Query:
Process Creation where Image contains 'cobalt' OR Image contains 'xenon' OR Image contains 'argon' OR Image contains 'lithium' AND CommandLine contains unusual parameters