{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-41392", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2025-07-08T17:12:36.294Z", "datePublished": "2025-08-18T21:07:20.484Z", "dateUpdated": "2025-08-19T13:34:52.678Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Cobalt", "vendor": "Ashlar-Vellum", "versions": [{"lessThan": "12.6.1204.204", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Xenon", "vendor": "Ashlar-Vellum", "versions": [{"lessThan": "12.6.1204.204", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Argon", "vendor": "Ashlar-Vellum", "versions": [{"lessThan": "12.6.1204.204", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Lithium", "vendor": "Ashlar-Vellum", "versions": [{"lessThan": "12.6.1204.204", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Cobalt Share", "vendor": "Ashlar-Vellum", "versions": [{"lessThan": "12.6.1204.204", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Michael Heinzl reported these vulnerabilities to CISA."}], "datePublic": "2025-08-12T17:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing AR files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.</span>\n\n</span>"}], "value": "In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing AR files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 8.4, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-08-18T21:07:20.484Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-01"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Ashlar-Vellum recommends users update to Versions <a target=\"_blank\" rel=\"nofollow\" href=\"https://download.ashlar.com/v12/index.html\">12.6.1204.204 and above</a>&nbsp;of the affected products.</p><ul><li>Ashlar-Vellum strongly recommends that all users update Cobalt, Xenon, Argon, Lithium, and Cobalt Share to the latest supported version by selecting Help &gt; Check Web for Updates from the application's main menu.</li><li>Users should only open CO/XE/AR/LI files or import supported file formats from trusted sources.</li></ul>\n\n<br>"}], "value": "Ashlar-Vellum recommends users update to Versions 12.6.1204.204 and above https://download.ashlar.com/v12/index.html \u00a0of the affected products.\n\n * Ashlar-Vellum strongly recommends that all users update Cobalt, Xenon, Argon, Lithium, and Cobalt Share to the latest supported version by selecting Help > Check Web for Updates from the application's main menu.\n * Users should only open CO/XE/AR/LI files or import supported file formats from trusted sources."}], "source": {"advisory": "ICSA-25-224-01", "discovery": "EXTERNAL"}, "title": "Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share Out-of-bounds Read", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-19T13:30:40.078755Z", "id": "CVE-2025-41392", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-19T13:34:52.678Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-41392", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-19T13:30:40.078755Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-19T13:34:46.648Z"}}], "cna": {"title": "Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share Out-of-bounds Read", "source": {"advisory": "ICSA-25-224-01", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Michael Heinzl reported these vulnerabilities to CISA."}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ashlar-Vellum", "product": "Cobalt", "versions": [{"status": "affected", "version": "0", "lessThan": "12.6.1204.204", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Ashlar-Vellum", "product": "Xenon", "versions": [{"status": "affected", "version": "0", "lessThan": "12.6.1204.204", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Ashlar-Vellum", "product": "Argon", "versions": [{"status": "affected", "version": "0", "lessThan": "12.6.1204.204", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Ashlar-Vellum", "product": "Lithium", "versions": [{"status": "affected", "version": "0", "lessThan": "12.6.1204.204", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Ashlar-Vellum", "product": "Cobalt Share", "versions": [{"status": "affected", "version": "0", "lessThan": "12.6.1204.204", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Ashlar-Vellum recommends users update to Versions 12.6.1204.204 and above https://download.ashlar.com/v12/index.html \u00a0of the affected products.\n\n * Ashlar-Vellum strongly recommends that all users update Cobalt, Xenon, Argon, Lithium, and Cobalt Share to the latest supported version by selecting Help > Check Web for Updates from the application's main menu.\n * Users should only open CO/XE/AR/LI files or import supported file formats from trusted sources.", "supportingMedia": [{"type": "text/html", "value": "<p>Ashlar-Vellum recommends users update to Versions <a target=\"_blank\" rel=\"nofollow\" href=\"https://download.ashlar.com/v12/index.html\">12.6.1204.204 and above</a>&nbsp;of the affected products.</p><ul><li>Ashlar-Vellum strongly recommends that all users update Cobalt, Xenon, Argon, Lithium, and Cobalt Share to the latest supported version by selecting Help &gt; Check Web for Updates from the application's main menu.</li><li>Users should only open CO/XE/AR/LI files or import supported file formats from trusted sources.</li></ul>\n\n<br>", "base64": false}]}], "datePublic": "2025-08-12T17:00:00.000Z", "references": [{"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-01"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing AR files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing AR files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.</span>\n\n</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2025-08-18T21:07:20.484Z"}}}, "cveMetadata": {"cveId": "CVE-2025-41392", "state": "PUBLISHED", "dateUpdated": "2025-08-19T13:34:52.678Z", "dateReserved": "2025-07-08T17:12:36.294Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2025-08-18T21:07:20.484Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ashlar:argon:*:*:*:*:*:*:*:*", "matchCriteriaId": "95A7E4D1-3731-48FA-BB27-B499036C69FA", "versionEndExcluding": "12.2.1204.204", "vulnerable": true}, {"criteria": "cpe:2.3:a:ashlar:cobalt:*:*:*:*:*:*:*:*", "matchCriteriaId": "683E952A-386A-41BC-8F4C-A85D8CB8FFEF", "versionEndExcluding": "12.2.1204.204", "vulnerable": true}, {"criteria": "cpe:2.3:a:ashlar:cobalt_share:*:*:*:*:*:*:*:*", "matchCriteriaId": "3ACA677B-71AB-4CBD-ACB5-10295875BAD7", "versionEndExcluding": "12.2.1204.204", "vulnerable": true}, {"criteria": "cpe:2.3:a:ashlar:lithium:*:*:*:*:*:*:*:*", "matchCriteriaId": "985AD816-CDF4-4770-9D41-D5AAC452EB2F", "versionEndExcluding": "12.2.1204.204", "vulnerable": true}, {"criteria": "cpe:2.3:a:ashlar:xenon:*:*:*:*:*:*:*:*", "matchCriteriaId": "C816096C-FE8C-4253-8FFA-077D0DBCFC60", "versionEndExcluding": "12.2.1204.204", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing AR files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process."}, {"lang": "es", "value": "En versiones de Ashlar-Vellum Cobalt, Xenon, Argon, Lithium y Cobalt Share anteriores a la 12.6.1204.204, las aplicaciones afectadas no validan correctamente los datos proporcionados por el usuario al analizar archivos AR. Esto podr\u00eda provocar una lectura fuera de los l\u00edmites. Un atacante podr\u00eda aprovechar esta vulnerabilidad para ejecutar c\u00f3digo arbitrario en el contexto del proceso actual."}], "id": "CVE-2025-41392", "lastModified": "2025-11-28T16:36:59.597", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2025-08-18T21:15:30.317", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-224-01"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}]}

{}

{"created": "2025-08-21T12:59:14.004062+00:00", "updated": "2025-08-21T12:59:14.004125+00:00", "vendors": ["ashlar", "ashlar$PRODUCT$argon", "ashlar$PRODUCT$cobalt", "ashlar$PRODUCT$lithium", "ashlar$PRODUCT$xenon"]}