Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share

An attacker with local access to a machine running vulnerable Ashlar-Vellum software could execute arbitrary code or steal sensitive information (such as design files or credentials) by tricking a user into opening a malicious file.

Organizations using Ashlar-Vellum design software (Cobalt, Xenon, Argon, Lithium, Cobalt Share) for CAD, engineering, or schematic design should be aware of this vulnerability. This affects engineering workstations and design computers, not directly OT control systems, but may impact OT environments where design files are created or modified on-site. The risk is primarily to engineers and design staff.

An attacker crafts a malicious file (likely a project or design file format that Ashlar-Vellum reads) and tricks a user into opening it. When the application processes the file, the buffer overflow is triggered, allowing the attacker to run code with the privileges of the user who opened the file.