CVE-2025-65085
Published: 25 November 2025
Summary
CVE-2025-65085 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Ashlar Argon. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-65085 is a heap-based buffer overflow vulnerability, classified under CWE-122, affecting Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share in versions 12.6.1204.207 and prior. Published on 2025-11-25, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.
The vulnerability can be exploited by a remote, unauthenticated attacker requiring low complexity and no user interaction. Successful exploitation could enable the attacker to disclose sensitive information or execute arbitrary code, resulting in high impacts to confidentiality, integrity, and availability.
The CISA ICS Advisory ICSA-25-329-01, available at https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-01, provides further details on this vulnerability, including recommended mitigations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-199616
Vulnerability details
A Heap-based Buffer Overflow vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated heap-based buffer overflow enables arbitrary code execution and info disclosure, directly mapping to exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all input to the application, which would block the malformed data that triggers the heap buffer overflow in Cobalt/Xenon/etc.
Mandates memory-protection mechanisms (e.g., ASLR, NX, guard pages) that raise the bar for successful exploitation of the heap overflow to achieve code execution or disclosure.
Requires prompt application of vendor patches that eliminate the vulnerable code paths in versions 12.6.1204.216 and earlier.