Loading story…
A heap-based buffer overflow vulnerability, tracked as CVE-2025-65085, has been identified in Ashlar-Vellum's suite of CAD products, including Cobalt, Xenon, Argon, Lithium, and Cobalt Share, affecting versions 12.6.1204.207 and earlier. This vulnerability could allow an attacker to disclose sensitive information or execute arbitrary code on affected systems, posing a significant risk to organizations using these products. The vulnerability is rated as high severity, with a CVSS v4 score of 8.4, and does not require remote exploitation, indicating that local access or user interaction may be necessary for exploitation.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory confirming the technical details and risk evaluation for this vulnerability. CISA notes that both an out-of-bounds write (CVE-2025-65084) and the heap-based buffer overflow (CVE-2025-65085) exist in the same product versions, both potentially leading to information disclosure or arbitrary code execution. Organizations using Ashlar-Vellum products are advised to review the advisories and apply any available mitigations or updates to reduce the risk of exploitation.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
In the advisory, Ashlar-Vellum's remediation guidance directed users to upgrade affected products to version 12.6.1204.208 or later to address both vulnerabilities. Additional defensive recommendations included restricting access to affected components and monitoring for unauthorized access or code execution.
CISA published advisory ICSA-25-329-01 for CVE-2025-65084 and CVE-2025-65085 affecting Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share version 12.6.1204.207 and earlier. The flaws were described as an out-of-bounds write and a heap-based buffer overflow that could enable information disclosure or arbitrary code execution, with no known public exploitation and no remote exploitability reported.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two newly recorded CVEs describe **stack-based buffer overflow** flaws that can lead to arbitrary code execution in legacy software components. **CVE-2017-20228** affects **Flat Assembler 1.71.21**, where oversized assembly input exceeding **5895 bytes** can overwrite the instruction pointer and enable **return-oriented programming (ROP)** for shell command execution. The issue is classified as **`CWE-787`** and carries high impact to confidentiality, integrity, and availability. A second entry, **CVE-2018-25222**, affects **SC v7.16** and similarly allows code execution through oversized input, in this case beyond **1052 bytes**, resulting in instruction pointer overwrite and shellcode execution in the application context. The vulnerability is also classified as **`CWE-787`**, with CVSS scoring indicating low attack complexity and severe impact, and both CVEs include references to **Exploit-DB** and **VulnCheck advisories**, signaling the availability of public technical details for defenders to review.
Jun 29, 2026
CISA published an ICS advisory for **CVE-2026-3437**, a **high-severity** memory safety issue (*CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer*) affecting **Portwell Engineering Toolkits v4.8.2**. The flaw is in the Portwell Engineering Toolkits **driver** and could allow a **local, authenticated attacker** to **read and write arbitrary memory**, enabling **privilege escalation** or **denial of service**; CISA scored it **CVSS v3.1 8.8 (High)** with a local attack vector and low complexity. The CVE record corroborates the same impact and affected version, and additionally lists a **CVSS v4.0** vector consistent with high impact to confidentiality, integrity, and availability. The vulnerability was reported to CISA by **Jason Huang** of **TXOne Networks** (Cyber Threat & Product Defense Center), and the advisory notes deployment across critical infrastructure environments (including **Energy** and **Critical Manufacturing**) with worldwide exposure.
Jun 29, 2026
Two high-severity vulnerabilities, **CVE-2019-25629** and **CVE-2019-25631**, affect **AIDA64 5.99.4900** products and can lead to local arbitrary code execution through structured exception handler (**SEH**) buffer overflows. The flaws were reported for **AIDA64 Extreme** and **AIDA64 Business**, respectively, and both are classified as **CWE-787** with a **CVSS v3.1** score vector of `AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating high impact across confidentiality, integrity, and availability. In **CVE-2019-25629**, an attacker can abuse the Hardware Monitoring logging feature in AIDA64 Extreme by supplying a malicious **CSV log file path**, triggering shellcode execution when the application processes that path. In **CVE-2019-25631**, AIDA64 Business is vulnerable through the **SMTP display name** field in preferences or the report wizard, where an attacker can overwrite SEH pointers and use **egg hunter shellcode** to gain code execution. Public references for both issues include vendor pages, **Exploit-DB** listings, and **VulnCheck** advisories.
Jun 29, 2026