An out‑of‑bounds write occurs when Ashlar‑Vellum attempts to parse a specially crafted VC6 file. The vulnerability, categorized as CWE‑787, allows an attacker to place data outside the intended memory bounds, which can lead to execution of arbitrary code. The impact includes full compromise of the affected system’s confidentiality, integrity, and availability.

The affected products are Ashlar‑Vellum Argon, Cobalt, Cobalt Share, Lithium, and Xenon. Any build of these products with version 12.6.1204.216 or earlier is vulnerable. Updated builds beginning with 12.6.1204.217 contain the fix.

The CVSS score of 8.4 reflects a high severity with a likely impact on the entire system. Although no EPSS score is provided, the lack of CVE exploitation data does not mitigate the risk posed by the serious vulnerability. The vulnerability has not been identified in CISA’s KEV catalog. The most likely attack vector would involve an attacker delivering a malicious VC6 file to a system that processes such files, which requires either direct file upload or remote code execution via a file‑parsing interface. Successful exploitation would give the attacker the ability to run arbitrary code on the target system.