CVE-2025-65088CWE-125

CVE-2025-65088

High · published May 13, 2026

CVSS v3.1

7.8

EPSS

Percentile

5.4

In the wild

Unconfirmed

What it is

An Out-of-Bounds Read vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code when a specially crafted VC6 file is being parsed.

The record

Technical detail

CVSS v3.1: 7.8 · HIGH
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00165 · 5.4th percentile
Weakness: CWE-125 · Out-of-bounds Read
Published: 2026-05-13T01:16Z

Affected products (5)

Product	Versions	Fixed in
ashlar/argon	≤ 12.6.1204.216	—
ashlar/cobalt	≤ 12.6.1204.216	—
ashlar/cobalt_share	≤ 12.6.1204.216	—
ashlar/lithium	≤ 12.6.1204.216	—
ashlar/xenon	≤ 12.6.1204.216	—

References (1)

https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-01 · [email protected]

EPSS history

Timeline

12 MAY 20:27Z
Out-of-bounds read in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share
cvelistv5