CVE-2023-39936— Ashlar-Vellum Graphite Out-of-bounds Read
Quick assessment
Affected
Ashlar-Vellum Graphite
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Ashlar Incorporated Ashlar-Vellum是Ashlar Incorporated公司的计算机辅助设计 (CAD) 和 3D 建模软件的开发平台。 Ashlar Incorporated Ashlar-Vellum Graphite v13.0.48 版本存在安全漏洞，该漏洞源于在解析 VC6 文件时，缺乏对用户提供的数据的正确验证。
Possible ATT&CK Techniques 1 AI
T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-39936
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ashlar-Vellum Graphite Out-of-bounds Read
Source: CVE Program / CVE List V5
Vulnerability Description
In Ashlar-Vellum Graphite v13.0.48, the affected application lacks proper validation of user-supplied data when parsing VC6 files. This could lead to an out-of-bounds read. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Vulnerability Title
Ashlar Incorporated Ashlar-Vellum Graphite 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Ashlar Incorporated Ashlar-Vellum是Ashlar Incorporated公司的计算机辅助设计 (CAD) 和 3D 建模软件的开发平台。 Ashlar Incorporated Ashlar-Vellum Graphite v13.0.48 版本存在安全漏洞，该漏洞源于在解析 VC6 文件时，缺乏对用户提供的数据的正确验证。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Ashlar-Vellum | Graphite | v13.0.48 | - |
|
II. Public POCs for CVE-2023-39936
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-39936
请登录查看更多情报信息。
Vendor Advisories for CVE-2023-39936 (1)
IV. Related Vulnerabilities
Same product: Graphite
-
CVE-2026-50593
Graphite-Web 数字错误漏洞 -
CVE-2025-7988
Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write -
CVE-2025-7987
Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write -
CVE-2025-7986
Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write -
CVE-2025-7983
Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Ov
Same vendor: Ashlar-Vellum
-
CVE-2026-19781
Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overf -
CVE-2025-65088
Out-of-bounds read in Ashlar-Vellum Cobalt, Xenon, Argon, Li -
CVE-2025-65087
Out-of-bounds read in Ashlar-Vellum Cobalt, Xenon, Argon, Li -
CVE-2025-65086
Out-of-bounds write in Ashlar-Vellum Cobalt, Xenon, Argon, L -
CVE-2025-65085
Heap-based Buffer Overflow in Ashlar-Vellum Cobalt, Xenon, A
Same weakness: CWE-125
-
CVE-2026-108960
Tiiny-AI PowerInfer FFN GPU-split Loader ggml-cuda.cu create -
CVE-2026-108955
Tiiny-AI PowerInfer GGUF ggml.c gguf_init_from_file out-of-b -
CVE-2026-81858
IBM i is Affected By A Denial of Service Vulnerability in Ho -
CVE-2026-85968
Out-of-bounds read in Progress MarkLogic Server -
CVE-2026-109281
ImageMagick 7.1.0-21 before 7.1.2-32 Heap Buffer Over-Read v
V. Comments for CVE-2023-39936
No comments yet