The vulnerability is an out-of-bounds read that can be triggered when the system parses a specially crafted VC6 file. The read allows sensitive data to be exposed and, in certain circumstances, supports execution of arbitrary code, which represents a high‑risk compromise of confidentiality, integrity, and availability.

Affected products include Ashlar‑Vellum Argon, Ashlar‑Vellum Cobalt, Ashlar‑Vellum Cobalt Share, Ashlar‑Vellum Lithium, and Ashlar‑Vellum Xenon. All versions up to and including build 12.6.1204.216 are affected; upgrades to build 12.6.1204.217 or later are required.

The CVSS score of 8.4 indicates significant severity. The EPSS score is undefined, so the current probability of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to provide a malicious VC6 file that the vulnerable software will parse, so the attack vector is likely local or via a network path that delivers that file to the system.