Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share

An attacker could execute arbitrary code on a workstation running these design/CAD applications if a user opens a malicious file, potentially compromising engineering data, control system configurations, or enabling lateral movement to connected ICS networks.

Engineering teams and design departments using Ashlar-Vellum CAD/design software (Cobalt, Xenon, Argon, Lithium, Cobalt Share) on workstations connected to or near control system networks. This affects industries such as architecture, engineering, utilities, and manufacturing where these tools are used to design or modify control system layouts and configurations.

An attacker crafts a malicious CO, XE, AR, or LI file (or supported import format) containing specially crafted data that triggers a buffer overflow in the parsing logic. If a user opens this file in the vulnerable application, the overflow allows the attacker to execute arbitrary code with the privileges of the logged-in user.