Security Resilience

CVE-2025-53705

Memory Safety in Ashlar Argon ≤ 12.2.1204.204

Memory Safety
Published
18 August 2025
Modified
17 June 2026
CVSS Score v4 8.4
Click a component to see what it means
Raw vectorCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0016 5th percentile
Risk Priority 55 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2025-53705 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Ashlar Argon. Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing CO files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to…

more

execute arbitrary code in the context of the current process.

CWE(s)
CWE-787

Related Threats

MITRE ATT&CK Enterprise Techniques

T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
T1212 Exploitation for Credential Access Credential Access
Adversaries may exploit software vulnerabilities in an attempt to collect credentials.
attack.mitre.org →
T1584.008 Network Devices Resource Development
Adversaries may compromise third-party network devices that can be used during targeting.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-39427Same product: Ashlar Argon
CVE-2023-34290Same product: Ashlar Cobalt
CVE-2023-34304Same product: Ashlar Cobalt
CVE-2024-13044Same product: Ashlar Cobalt
CVE-2024-13046Same product: Ashlar Cobalt
CVE-2023-34291Same product: Ashlar Cobalt
CVE-2023-34286Same product: Ashlar Cobalt
CVE-2025-2020Same product: Ashlar Cobalt
CVE-2023-34305Same product: Ashlar Cobalt
CVE-2024-13048Same product: Ashlar Cobalt

Affected Assets

ashlar
argon
≤ 12.2.1204.204
ashlar
cobalt
≤ 12.2.1204.204
ashlar
cobalt share
≤ 12.2.1204.204
ashlar
lithium
≤ 12.2.1204.204
ashlar
xenon
≤ 12.2.1204.204

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation (including fuzzing and bounds checks) finds out-of-bounds write flaws before deployment.

SA-15 Development Process, Standards, and Tools partial match

Requiring documented secure-development standards and tools can mandate bounds-checked coding practices that avoid the weakness.

SI-10 Information Input Validation partial match

Input validation can structurally reject or sanitize data that would otherwise trigger an out-of-bounds write.

SI-16 Memory Protection partial match

Memory-protection mechanisms limit the exploitability and blast radius of a successful out-of-bounds write.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
blocks

Secure-development practices (static analysis, bounds checking, code review) are the primary means of preventing out-of-bounds writes.

ID.RA-01 partial match
blocks

Vulnerability scanning and recording can discover out-of-bounds write flaws so they can be remediated.

PR.PS-02 partial match
blocks

Patching or replacing vulnerable software directly eliminates known instances of this coding weakness.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing in development and acceptance can detect and prevent out-of-bounds write defects.

A.8.28 Secure coding partial match
prevents

Secure coding directly addresses out-of-bounds writes through language choice and coding standards.

References