CVE-2023-44439 is a high severity uncontrolled search path flaw in Ashlar-Vellum Xenon. NVD scores it 8.8 and ZDI scores it 7.8. The advisory says it is fixed in version 12.0.1204.78, so update from 12.0.1204.68 and treat files from unknown sources with care until you do.
What's affected
The record lists Ashlar-Vellum Xenon version 12.0.1204.68 as affected. The Zero Day Initiative advisory ZDI-23-1597 (ZDI-CAN-21679), dated 14 November 2023, says the issue is fixed in version 12.0.1204.78. The NVD record was published on 2024-05-03.
The sources disagree on severity. NVD scores it 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which has a network attack vector. ZDI scores it 7.8 with a local attack vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Both are High, and both are reported here. The difference matters for planning: a local vector fits a file someone opens on their own machine.
The flaw is in the parsing of various file types. The process loads a library from an unsecured location, and an attacker who controls that location can run code in the context of the current process. User interaction is required, since the target must open a malicious file or visit a malicious page.
Two sibling records cover the same flaw in other products of the same suite: CVE-2023-44438 (Argon), CVE-2023-44440 (Lithium). All three share the version numbers above, so update every Ashlar-Vellum application you have.
Weakness class: CWE-427 (uncontrolled search path element).
How to check if you're exposed
Open the application, then Help, then About, and read the version number. Version 12.0.1204.68 is the one named in the record. Anything earlier than 12.0.1204.78 should be treated as exposed until you confirm otherwise with the vendor.
On Windows, you can also look at the installed programs list under Settings, Apps, Installed apps, which shows the version for each Ashlar-Vellum product. Check shared workstations and any machine where CAD files arrive from outside your company.
What to do now
- List every machine with Ashlar-Vellum Xenon, Argon, Xenon or Lithium installed, with the version.
- Update to 12.0.1204.78 or later, as the ZDI advisory states, and confirm the version afterwards.
- Until updated, open only files from sources you trust, and avoid opening files received by email or downloaded from unknown sites.
- Check the folders where the application looks for libraries, and make sure ordinary users cannot write to them.
- Add these products to your software inventory so the next advisory is easy to match.
Why it matters
An uncontrolled search path element means a program loads code, such as a DLL, from a place an attacker can influence. If the program looks in the wrong folder first, a planted library is run with the program's rights. The class is CWE-427. The fix is usually to load libraries only from fixed, protected locations.
Design and engineering software is often installed on powerful workstations with access to valuable files, and the files it opens come from partners and suppliers. That makes a file based attack realistic even when the score is only High. CVE-2023-44439 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay.
Desktop applications like this one are outside what Safeguard's free in-browser dependency scan checks, which covers the dependencies in your own code. Keep them in your endpoint inventory and patch process.
Quick check
Which version fixes CVE-2023-44439?
ZDI says version 12.0.1204.78. The record lists 12.0.1204.68 as affected.
Why do the scores for CVE-2023-44439 differ?
NVD gives 8.8 with a network vector. ZDI gives 7.8 with a local vector. Both are High.
Sources
Last reviewed: 19 October 2026.
