This vulnerability (CWE-125) involves an out-of-bounds read in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and earlier. The flaw is triggered by processing maliciously crafted VC6 files, potentially leading to information disclosure or arbitrary code execution. The CVSS 4.0 vector indicates local attack vector with low complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by the vendor as of the data available.

Successful exploitation could allow an attacker to read memory outside intended bounds, potentially disclosing sensitive information or executing arbitrary code on the affected system. This could compromise confidentiality, integrity, and availability of the system running the vulnerable Ashlar-Vellum products.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid opening untrusted VC6 files and limit user interaction with such files. Monitor vendor communications for updates on patches or mitigations.