Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share

CISA advisory reveals critical vulnerabilities in Ashlar-Vellum CAD software products including Cobalt, Xenon, Argon, Lithium, and Cobalt Share. Two high-severity vulnerabilities (CVE-2025-65084 and CVE-2025-65085) affect versions 12.6.1204.207 and prior, including an Out-of-Bounds Write (CWE-787) and Heap-based Buffer Overflow (CWE-122). Both vulnerabilities have CVSS v4 scores of 8.4 and could allow attackers to disclose information or execute arbitrary code. The vulnerabilities require local access and user interaction but have low attack complexity. Ashlar-Vellum has released patches in version 12.6.1204.208 and higher for all affected products.