An out-of-bounds read vulnerability (CWE-125) exists in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and earlier. The issue arises during the parsing of specially crafted VC6 files, potentially enabling information disclosure or arbitrary code execution. The CVSS 4.0 vector indicates local attack vector with low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor as of the data provided.

Successful exploitation could lead to disclosure of sensitive information or arbitrary code execution on affected systems. This could compromise system confidentiality, integrity, and availability. However, no known exploits are reported in the wild, and the attack requires local access and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid opening untrusted VC6 files and limit user interaction with such files. Monitor vendor communications for updates on patches or mitigations.