CVE-2025-7979
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A vulnerability in Ashlar-Vellum Graphite when parsing VC6 files is caused by a stack-based buffer overflow. A remote attacker can execute arbitrary code if the user opens a malicious file or visits a malicious page.
Risk Assessment
This can lead to full compromise of an engineer's workstation and theft of design data. It requires user interaction, but the risk is high in CAD environments.
Recommendation
Update Ashlar-Vellum Graphite to the latest version and avoid opening VC6 files from untrusted sources. Enforce least privilege and email filtering.
Other vulnerabilities in Ashlar-Vellum Graphite
See all- CVE-2025-7988High
An out-of-bounds write vulnerability in Ashlar-Vellum Graphite during VC6 file parsing allows remote code execution. User interaction is required — the target must open a malicious file or visit a malicious page. The flaw stems from lack of validation of user-supplied data, resulting in a write past the end of an allocated buffer.
- CVE-2025-7987High
An out-of-bounds write vulnerability in Ashlar-Vellum Graphite during VC6 file parsing allows remote code execution. User interaction is required — the target must open a malicious file or visit a malicious page. The flaw stems from lack of validation of user-supplied data, resulting in a write past the end of an allocated buffer.
- CVE-2025-7986High
An out-of-bounds write vulnerability in Ashlar-Vellum Graphite during VC6 file parsing allows remote code execution. User interaction is required — the target must open a malicious file or visit a malicious page. The flaw stems from lack of validation of user-supplied data, resulting in a write past the end of an allocated buffer.
- CVE-2025-7983High
A vulnerability in Ashlar-Vellum Graphite when parsing VC6 files is caused by a heap-based buffer overflow. A remote attacker can execute arbitrary code if the user opens a malicious file or visits a malicious page.
- CVE-2025-7981High
A vulnerability in Ashlar-Vellum Graphite when parsing VC6 files is caused by use of an uninitialized variable. A remote attacker can execute arbitrary code if the user opens a malicious file or visits a malicious page.
- CVE-2025-7980High
A vulnerability in Ashlar-Vellum Graphite when parsing VC6 files is caused by an out-of-bounds write. A remote attacker can execute arbitrary code if the user opens a malicious file or visits a malicious page.
- CVE-2025-7978High
A vulnerability in Ashlar-Vellum Graphite when parsing VC6 files is caused by use of an uninitialized variable. A remote attacker can execute arbitrary code if the user opens a malicious file or visits a malicious page.
Original NVD description (English source)
Ashlar-Vellum Graphite VC6 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25463.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS