An Out-of-Bounds Read vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an at…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 12, 2026 · NIST NVD

   Detected

   An Out-of-Bounds Read vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code when a specially crafted VC6 file is being parsed.

2. Oct 14, 2026 · NIST NVD

   Updated

   An Out-of-Bounds Read vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code when a specially crafted VC6 file is being parsed.

Affected

• cpe ashlar/argonversion unspecified
• cpe ashlar/cobaltversion unspecified
• cpe ashlar/cobalt shareversion unspecified
• cpe ashlar/lithiumversion unspecified
• cpe ashlar/xenonversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2025-65087

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-65087

  30-day exploitation probability 0.2%

  first.org
• NIST NVDVulnerability recordCVE-2025-65087

  An Out-of-Bounds Read vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code when a specially crafted VC6 file is being parsed.

  nvd.nist.gov

References

• Third Party Advisory · cisa.gov