PatchSiren cyber security CVE debrief

CVE-2025-65087 Ashlar-Vellum CVE debrief

An out-of-bounds read vulnerability exists in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior. The flaw occurs during parsing of specially crafted VC6 files and may allow an attacker to disclose information or execute arbitrary code. The vulnerability was disclosed by CISA on November 25, 2025, with an update published on May 12, 2026, that revised affected product versions and mitigation guidance. The vendor has released build 12.6.1204.217 to address this issue.

Vendor: Ashlar-Vellum
Product: Cobalt
CVSS: HIGH 7.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-11-25
Original CVE updated: 2026-05-12
Advisory published: 2025-11-25
Advisory updated: 2026-05-12

Who should care

Organizations using Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, or Cobalt Share for CAD and 3D modeling, particularly in industrial or engineering environments where VC6 files may be exchanged externally.

Technical summary

The vulnerability is an out-of-bounds read (CWE-125) triggered when parsing malformed VC6 files in Ashlar-Vellum's CAD and 3D modeling product suite. Local attack vector with user interaction required; successful exploitation yields high impact on confidentiality, integrity, and availability.

Defensive priority

HIGH

Recommended defensive actions

Update Ashlar-Vellum products to build 12.6.1204.217 or later
Restrict access to VC6 files from untrusted sources
Apply defense-in-depth strategies for industrial control systems
Train users to recognize and avoid phishing attempts that may deliver malicious files

Evidence notes

CISA ICS Advisory ICSA-25-329-01 (Update A) documents this vulnerability with CVSS 3.1 score 7.8. The advisory was initially published 2025-11-25 and modified 2026-05-12 to revise mitigation section, affected product versions, and add CVE identifiers. SSVCv2 scoring indicates Exploitation: None, Automatable: No.

Sources and references

Verified primary and authoritative sources

CVE-2025-65087 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2025-65087

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2025-65087 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2025-65087

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-329-01.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.