CVE-2025-65085 is a heap-based buffer overflow in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium and Cobalt Share, build 12.6.1204.216 and earlier. The record scores it 9.8 critical, while CISA's advisory scores it 7.8 high. The vendor recommends build 12.6.1204.217 or later, so update and keep these tools off exposed networks.
What's affected
Ashlar-Vellum Cobalt, Xenon, Argon, Lithium and Cobalt Share, all at versions 12.6.1204.216 and prior. The vendor recommends updating to build 12.6.1204.217 or later, according to the CISA advisory ICSA-25-329-01.
Here is the severity conflict, and it is a large one. The record carries a CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), which is Critical, with a network attack vector. The CISA advisory, revised as Update A, lists this entry at CVSS 3.1 7.8 High (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and CVSS 4.0 8.4 High. That vector is local and needs user interaction.
Both numbers are published, so use both. The difference changes how urgent this is for you. A local, user-assisted flaw in a design application matters most where people open files from outside. A network flaw would matter most where the application listens on a network. The description in both sources is the same: the weakness could allow an attacker to disclose information or execute arbitrary code. CISA lists the sector as critical manufacturing, with deployment worldwide.
How to check if you're exposed
Look at the build number of each Ashlar-Vellum product on your design and engineering machines. In the application, the About dialog shows the build. Compare it with 12.6.1204.216. Anything at or below that number is affected.
Your software inventory or endpoint tool can also report installed versions, so filter for Cobalt, Xenon, Argon, Lithium and Cobalt Share. Include shared workstations and any servers that run Cobalt Share.
Then ask where these tools get files from. Files from email, downloads, supplier portals or shared drives are the usual route into this kind of application. If the files are all produced in house, your exposure is lower than if staff open drawings from outside parties.
What to do now
- Update every installation to build 12.6.1204.217 or later, following the vendor's instructions.
- Until you have updated, avoid opening files from untrusted sources in these applications.
- Follow the CISA recommended practices. Keep control system and engineering devices off the internet, put them behind firewalls and separate them from business networks.
- Where remote access is needed, use a VPN and keep the VPN itself up to date.
- Record both severity scores in your ticket, so reviewers can see why you chose the priority you did.
Why it matters
The weakness is a heap-based buffer overflow (CWE-122). Memory for a buffer is allocated on the heap, and the program then writes more data into it than it can hold. The extra data lands in neighboring heap memory, which can corrupt program state and, in the worst case, allow code to run.
This flaw was published together with several others in the same CISA advisory, including an out-of-bounds write and out-of-bounds reads. When one advisory covers many memory safety bugs in one product line, the sensible response is to move the whole product to the fixed build, not to chase single CVEs. It also pays to keep a list of the file formats each tool opens from outside. The record does not say this was exploited in the wild, and the KEV flag is false. The free Safeguard dependency scan can list the packages in a project and flag known CVEs, and the Gold directory keeps a page for each one.
Quick check
Why do the record and CISA disagree on severity?
They use different CVSS vectors. The record uses a network vector with no user interaction, which gives 9.8. CISA uses a local vector with user interaction, which gives 7.8. Cite both and decide based on how files reach your machines.
What is the fixed version for CVE-2025-65085?
The CISA advisory says the vendor recommends build 12.6.1204.217 and later.
Sources
Last reviewed: 18 October 2026.
