CVE-2023-34306 is a stack-based buffer overflow in the VC6 file parser of Ashlar-Vellum Graphite 13.0.46, scored 8.8 High by NVD. Opening a malicious file can lead to code execution. The ZDI advisory names no fixed version, so check the vendor's release notes.
What's affected
The record lists Ashlar-Vellum Graphite version 13.0.46 as affected. The flaw is in the parsing of VC6 files. The advisory says the code copies user-supplied data into a stack buffer without checking its length.
The ZDI advisory for this issue does not name a fixed version. It records that the vendor said on 8 June 2023 that the flaw would be fixed in a future build, and that ZDI published the case as a zero-day advisory on 15 June 2023. I could not confirm a fixed release, so check Ashlar-Vellum's current release notes before you rely on any version.
ZDI reported the issue to the vendor on 4 October 2022.
How to check if you're exposed
This is desktop software, so look at the installed version rather than at a network port. Open the application's About dialog, or on Windows open Settings, then Apps, and read the version shown for the product.
If you manage a fleet, ask your software inventory or endpoint tool for every machine with the product installed, plus the version. Include design workstations, shared drives with install media and virtual machines, since these are easy to miss.
Also list where the file types in question arrive from. Drawings often come by email from suppliers and clients, so a mail attachment filter that logs the extension in question is a useful source of evidence.
What to do now
- Check Ashlar-Vellum's release notes and support channels for a Graphite release that fixes this issue, and install it once you can confirm it. The ZDI advisory names no fixed version.
- Until you have updated, do not open VC6 files from outside sources. Ask suppliers and clients to send neutral formats where they can.
- Handle drawings from untrusted senders in a separate account or virtual machine without access to shared drives.
- Tell design staff about the risk in plain words: a file that looks like a drawing can be the attack.
- Add the software to your asset list with its version so the next advisory is a lookup.
Why it matters
A stack-based buffer overflow copies more data than a fixed size buffer on the stack can hold. The extra bytes overwrite neighboring memory, which can include data that controls where the program goes next. The advisory says the length of data from the file is not validated before the copy.
Because the input is a file, the risk follows your workflow. If your team receives VC6 drawings from outside, every one is a possible carrier until the software is updated.
The weakness classes involved are CWE-121 (Stack-based Buffer Overflow), CWE-787 (Out-of-bounds Write). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Source conflict: NVD scores this CVE 8.8 with a network vector (AV:N). The ZDI advisory lists 7.8 with a local vector (AV:L/AC:L). Both are shown here. The advisory also names no fixed version.
Quick check
Do I need to be attacked over the network?
No. The attacker needs a user to open a malicious file or visit a malicious page, so the weakness is reached through the file the application parses.
Is there a fixed version?
The ZDI advisory does not name one. The vendor said a fix would come in a future build, so check the vendor's current release notes.
Sources
Last reviewed: 19 October 2026.
