PT-2023-26946 · Ashlar Vellum · Lithium+4

Michael Heinzl · Published 2023-10-26 · Updated 2025-08-08 · CVE-2023-39427

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share version 12 SP0 Build (1204.77)

Description The affected applications lack proper validation of user-supplied data when parsing XE files, which could lead to an out-of-bounds write. An attacker could leverage this issue to execute arbitrary code in the context of the current process.

Recommendations For version 12 SP0 Build (1204.77), consider disabling the parsing of XE files until a patch is available to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2023-39427

Affected Products

Argon

Ashlar-Vellum Cobalt

Cobalt Share

Lithium

Xenon

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-39427 · Security Note
• https://osv.dev/vulnerability/CVE-2023-39427 · Vendor Advisory
• https://t.me/cibsecurity/73006 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1717675135556096245 · Twitter Post
• https://twitter.com/CVEnew/status/1717626711284629528 · Twitter Post
• https://t.me/cvenotify/60050 · Telegram Post
• https://t.me/cveNotify/131456 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-299-03 · Note