CVE-2025-7978: Ashlar Graphite VC6 RCE Vulnerability

CVE-2025-7978 Overview

CVE-2025-7978 is a high-severity remote code execution vulnerability in Ashlar-Vellum Graphite, a computer-aided design (CAD) application. The flaw resides in the VC6 file format parser and stems from the use of uninitialized memory [CWE-457]. Attackers can leverage the issue to execute arbitrary code in the context of the current user process.

Exploitation requires user interaction. A victim must open a crafted VC6 file or visit a malicious page that delivers one. The vulnerability was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-25459 and disclosed in advisory ZDI-25-632.

Critical Impact
Successful exploitation yields arbitrary code execution with the privileges of the user running Ashlar-Vellum Graphite, enabling full compromise of the affected workstation.

Affected Products

Ashlar-Vellum Graphite 13.0.48
CAD workstations processing untrusted VC6 design files
Engineering and design environments using vulnerable Graphite installations

Discovery Timeline

2025-09-17 - CVE-2025-7978 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7978

Vulnerability Analysis

The vulnerability resides in the VC6 file parsing component of Ashlar-Vellum Graphite. The parser accesses memory regions before properly initializing them. This uninitialized variable usage [CWE-457] allows an attacker to influence values consumed by subsequent code paths, including pointers and control data.

Because the affected logic operates on attacker-supplied file content, a crafted VC6 file can place predictable or attacker-controlled data into memory that the parser later treats as initialized. The result is corruption of program state that enables arbitrary code execution within the Graphite process. The attack vector is local, but delivery commonly occurs through phishing emails, web downloads, or shared design repositories.

Root Cause

The root cause is improper initialization of memory prior to use within the VC6 parser. The application reads from a buffer or stack location whose contents have not been deterministically set, then uses that value in operations such as pointer dereferences or branch decisions. Attackers shape file contents to ensure that the uninitialized region holds values that redirect execution.

Attack Vector

An attacker crafts a malicious .vc6 file and delivers it to a victim through email, a download link, or a compromised file share. When the victim opens the file in Ashlar-Vellum Graphite, the parser triggers the uninitialized variable condition. Code then executes with the privileges of the current user, with no further authentication required.

No public proof-of-concept code is available for this vulnerability. See the Zero Day Initiative Advisory ZDI-25-632 for vendor-coordinated technical details.

Detection Methods for CVE-2025-7978

Indicators of Compromise

Unexpected Graphite.exe child processes such as command shells, scripting engines, or rundll32.exe
VC6 files arriving from untrusted email senders or external file-sharing services
Crash dumps or Windows Error Reporting events referencing the Graphite VC6 parser module
Outbound network connections initiated by the Graphite process to unfamiliar hosts

Detection Strategies

Monitor process creation events where Ashlar-Vellum Graphite spawns interpreters, shells, or living-off-the-land binaries
Inspect file system telemetry for VC6 files written to user download or temp directories prior to Graphite execution
Correlate Graphite process crashes with subsequent suspicious activity on the same endpoint

Monitoring Recommendations

Enable endpoint detection and response (EDR) telemetry on workstations running CAD software
Forward process, file, and network events from CAD endpoints to a centralized data lake for retrospective hunting
Alert on Graphite processes loading unexpected DLLs from user-writable paths

How to Mitigate CVE-2025-7978

Immediate Actions Required

Inventory all systems running Ashlar-Vellum Graphite and identify version 13.0.48 installations
Restrict opening of VC6 files originating from untrusted sources until a vendor patch is applied
Apply application allowlisting to limit which child processes Graphite is permitted to spawn
Train CAD users to validate the provenance of design files before opening them

Patch Information

At the time of publication, consult the Zero Day Initiative Advisory ZDI-25-632 for the latest vendor remediation status. Apply any updated Ashlar-Vellum Graphite release that addresses the VC6 parser issue as soon as it is available.

Workarounds

Block inbound .vc6 file attachments at the email gateway pending patch deployment
Open untrusted VC6 files only inside an isolated virtual machine or sandbox environment
Run Ashlar-Vellum Graphite under a least-privilege user account to limit post-exploitation impact
Disable file association handlers that automatically launch Graphite on VC6 downloads

bash

# Configuration example: block VC6 attachments at an example mail filter
# (adapt to your specific email security product)
rule "Block-Untrusted-VC6" {
    match attachment.extension == "vc6"
    when sender.domain not in trusted_partners
    action quarantine
    notify security_team
}