CVE-2023-34307 is an out-of-bounds write in the VC6 file parser of Ashlar-Vellum Graphite 13.0.46, scored 8.8 High by NVD. Opening a malicious file can lead to code execution. The ZDI advisory names no fixed version, so check the vendor's release notes.
What's affected
The record lists Ashlar-Vellum Graphite version 13.0.46 as affected. The flaw is in the parsing of VC6 files. The advisory says user-supplied data is not validated, which allows a write past the end of an allocated buffer.
The ZDI advisory for this issue does not name a fixed version. It records that the vendor said on 8 June 2023 that the flaw would be fixed in a future build, and that ZDI published the case as a zero-day advisory on 15 June 2023. I could not confirm a fixed release, so check Ashlar-Vellum's current release notes before you rely on any version.
ZDI reported the issue to the vendor on 4 October 2022.
How to check if you're exposed
This is desktop software, so look at the installed version rather than at a network port. Open the application's About dialog, or on Windows open Settings, then Apps, and read the version shown for the product.
If you manage a fleet, ask your software inventory or endpoint tool for every machine with the product installed, plus the version. Include design workstations, shared drives with install media and virtual machines, since these are easy to miss.
Also list where the file types in question arrive from. Drawings often come by email from suppliers and clients, so a mail attachment filter that logs the extension in question is a useful source of evidence.
What to do now
- Check Ashlar-Vellum's release notes and support channels for a Graphite release that fixes this issue, and install it once you can confirm it. The ZDI advisory names no fixed version.
- Until you have updated, do not open VC6 files from outside sources. Ask suppliers and clients to send neutral formats where they can.
- Handle drawings from untrusted senders in a separate account or virtual machine without access to shared drives.
- Tell design staff about the risk in plain words: a file that looks like a drawing can be the attack.
- Add the software to your asset list with its version so the next advisory is a lookup.
Why it matters
An out-of-bounds write means the program stores data beyond the edge of the memory it reserved. Attackers value this class because the written data and its location can often be shaped by the file they control.
Graphite is one of several issues reported in the same product family at the same time, so a patch for this CVE is likely to arrive with others. Waiting for the vendor's next build and reading its notes closely is the practical path.
The weakness classes involved are CWE-787 (Out-of-bounds Write). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Source conflict: NVD scores this CVE 8.8 with a network vector (AV:N). The ZDI advisory lists 7.8 with a local vector (AV:L/AC:L). Both are shown here. The advisory also names no fixed version.
Quick check
Do I need to be attacked over the network?
No. The attacker needs a user to open a malicious file or visit a malicious page, so the weakness is reached through the file the application parses.
Is there a fixed version?
The ZDI advisory does not name one. The vendor said a fix would come in a future build, so check the vendor's current release notes.
Sources
Last reviewed: 19 October 2026.
