CVE-2025-65084 is a out-of-bounds write in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium and Cobalt Share, build 12.6.1204.216 and earlier. The record scores it 9.8 critical, while CISA's advisory scores it 7.8 high. The vendor recommends build 12.6.1204.217 or later, so update and keep these tools off exposed networks.
What's affected
Ashlar-Vellum Cobalt, Xenon, Argon, Lithium and Cobalt Share, all at versions 12.6.1204.216 and prior. The vendor recommends updating to build 12.6.1204.217 or later, according to the CISA advisory ICSA-25-329-01.
Here is the severity conflict, and it is a large one. The record carries a CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which is Critical, with a network attack vector. The CISA advisory, revised as Update A, lists this entry at CVSS 3.1 7.8 High (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and CVSS 4.0 8.4 High. That vector is local and needs user interaction.
Both numbers are published, so use both. The difference changes how urgent this is for you. A local, user-assisted flaw in a design application matters most where people open files from outside. A network flaw would matter most where the application listens on a network. The description in both sources is the same: the weakness could allow an attacker to disclose information or execute arbitrary code. CISA lists the sector as critical manufacturing, with deployment worldwide.
How to check if you're exposed
Look at the build number of each Ashlar-Vellum product on your design and engineering machines. In the application, the About dialog shows the build. Compare it with 12.6.1204.216. Anything at or below that number is affected.
Your software inventory or endpoint tool can also report installed versions, so filter for Cobalt, Xenon, Argon, Lithium and Cobalt Share. Include shared workstations and any servers that run Cobalt Share.
Then ask where these tools get files from. Files from email, downloads, supplier portals or shared drives are the usual route into this kind of application. If the files are all produced in house, your exposure is lower than if staff open drawings from outside parties.
What to do now
- Update every installation to build 12.6.1204.217 or later, following the vendor's instructions.
- Until you have updated, avoid opening files from untrusted sources in these applications.
- Follow the CISA recommended practices. Keep control system and engineering devices off the internet, put them behind firewalls and separate them from business networks.
- Where remote access is needed, use a VPN and keep the VPN itself up to date.
- Record both severity scores in your ticket, so reviewers can see why you chose the priority you did.
Why it matters
The weakness is an out-of-bounds write (CWE-787). The program writes data past the end of a buffer it allocated, which can overwrite nearby memory. In native applications that parse complex file formats, that is a common route to code execution, because the attacker influences both what is written and where.
This family of advisories is a reminder that engineering and design software is part of the attack surface. These tools run on powerful workstations, hold valuable designs and often sit on networks that were built for convenience. They also tend to be updated rarely. Putting these applications in your asset inventory is the first step. The record does not say this was exploited in the wild, and the KEV flag is false. The free Safeguard dependency scan can list the packages in a project and flag known CVEs, and the Gold directory keeps a page for each one.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why do the record and CISA disagree on severity?
They use different CVSS vectors. The record uses a network vector with no user interaction, which gives 9.8. CISA uses a local vector with user interaction, which gives 7.8. Cite both and decide based on how files reach your machines.
What is the fixed version for CVE-2025-65084?
The CISA advisory says the vendor recommends build 12.6.1204.217 and later.
Sources
Last reviewed: 18 October 2026.
