Cyber Posture

CVE-2025-65085

Critical

Published: 25 November 2025

Published
25 November 2025
Modified
28 November 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0012 31.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

A Heap-based Buffer Overflow vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.207 and prior that could allow an attacker to disclose information or execute arbitrary code.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires timely remediation of the heap-based buffer overflow flaw through patching to versions beyond 12.6.1204.207.

prevent

Implements memory protection mechanisms like ASLR and DEP to prevent exploitation of heap buffer overflows for arbitrary code execution.

prevent

Enforces input validation to block malformed inputs that trigger the heap-based buffer overflow vulnerability.

Security SummaryAI

CVE-2025-65085 is a heap-based buffer overflow vulnerability, classified under CWE-122, affecting Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share in versions 12.6.1204.207 and prior. Published on 2025-11-25, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.

The vulnerability can be exploited by a remote, unauthenticated attacker requiring low complexity and no user interaction. Successful exploitation could enable the attacker to disclose sensitive information or execute arbitrary code, resulting in high impacts to confidentiality, integrity, and availability.

The CISA ICS Advisory ICSA-25-329-01, available at https://www.cisa.gov/news-events/ics-advisories/icsa-25-329-01, provides further details on this vulnerability, including recommended mitigations.

Details

CWE(s)

Affected Products

ashlar
argon
≤ 12.2.1204.207
ashlar
cobalt
≤ 12.2.1204.207
ashlar
cobalt share
≤ 12.2.1204.207
ashlar
lithium
≤ 12.2.1204.207
ashlar
xenon
≤ 12.2.1204.207

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Remote unauthenticated heap-based buffer overflow enables arbitrary code execution and info disclosure, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References