Ashlar-Vellum Graphite VC6 File Parsing OOB Write RCE (CVE-2025-7986)

Critical Vulnerability Information Vulnerability Name: (0Day) Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability ZDI ID: ZDI-25-639, ZDI-CAN-25755 CVE ID: CVE-2025-7986 CVSS Score: 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Affected Vendor: Ashlar-Vellum Affected Product: Graphite Vulnerability Details Description: This vulnerability allows remote attackers to execute arbitrary code on affected Ashlar-Vellum Graphite installations. Exploitation requires user interaction, where the target must access a malicious page or open a malicious file. Specific Issue: A specific flaw exists during the parsing of VC6 files. Due to insufficient validation of user-supplied data, the vulnerability results in a write operation beyond the end of an allocated buffer. Attackers can leverage this to execute code within the context of the current process. Additional Details Report Date: December 19, 2024 – ZDI reported the vulnerability to the vendor Update Request: May 2, 2025 – ZDI requested an update Notification of Disclosure: July 15, 2025 – ZDI notified the vendor that the case would be published as a 0-day disclosure Mitigation: Given the nature of the vulnerability, the only effective mitigation is to restrict interaction with the product Disclosure Timeline Reported to Vendor: December 19, 2024 Coordinated Public Release: July 22, 2025 Announcement Update: July 22, 2025 Acknowledgments Discoverer: Rocco Calvi (@TecR0c) with TecSecurity

Goal Reached Thanks to every supporter — we hit 100%!

Ashlar-Vellum Graphite VC6 File Parsing OOB Write RCE (CVE-2025-7986)