CVE-2025-7981: Ashlar Graphite VC6 RCE Vulnerability

CVE-2025-7981 Overview

CVE-2025-7981 is an uninitialized variable vulnerability in Ashlar-Vellum Graphite that enables arbitrary code execution when the application parses a crafted VC6 file. The flaw resides in the VC6 file parsing logic, where memory is accessed before being properly initialized [CWE-457]. Attackers can leverage this condition to execute code in the context of the current process. Exploitation requires user interaction, as the target must open a malicious file or visit a malicious page that delivers one. The vulnerability was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-25475.

Critical Impact
Successful exploitation grants attackers arbitrary code execution with the privileges of the user running Ashlar-Vellum Graphite, enabling full compromise of the local user context.

Affected Products

Ashlar-Vellum Graphite 13.0.48
Ashlar-Vellum Graphite (VC6 file parser component)
Workstations running vulnerable Graphite installations

Discovery Timeline

2025-09-17 - CVE-2025-7981 published to NVD
2026-06-17 - Last updated in NVD database
Reference - Disclosed via Zero Day Initiative Advisory ZDI-25-634

Technical Details for CVE-2025-7981

Vulnerability Analysis

The vulnerability is classified as Use of Uninitialized Variable [CWE-457]. When Graphite parses a VC6 file, the parser reads or operates on memory that was never initialized to a known value. Attackers who control the contents of the VC6 file can influence the uninitialized memory state and steer program flow to attacker-controlled code paths. Because the flaw triggers during normal file parsing, no privileged access is required on the target system. The attacker only needs to convince a user to open a malicious VC6 document delivered through email, web download, or a shared design repository.

Root Cause

The root cause is the absence of proper memory initialization prior to use within the VC6 parsing routines. Variables, structure fields, or buffers are accessed before being assigned deterministic values. When the attacker-controlled file format influences the surrounding allocator state, the uninitialized values can be coerced into pointers, lengths, or indices that the parser dereferences or trusts. This primitive can be chained into memory corruption and ultimately arbitrary code execution.

Attack Vector

The attack vector is local but requires user interaction. An attacker crafts a malicious .vc6 file and delivers it through phishing, drive-by download, or a compromised file share. When the user opens the file in Ashlar-Vellum Graphite, the vulnerable parser processes the attacker-controlled data and triggers the uninitialized memory use. Code execution occurs in the context of the current process, which in most workstation deployments runs with standard user privileges that are still sufficient for credential theft, lateral movement, and persistence.

No public proof-of-concept code is available. See the Zero Day Initiative Advisory ZDI-25-634 for additional technical context.

Detection Methods for CVE-2025-7981

Indicators of Compromise

Unexpected Graphite.exe child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned after opening a VC6 file
VC6 files arriving from untrusted email senders, web downloads, or unmanaged file shares
Crash dumps or Windows Error Reporting events referencing Graphite modules during file open operations
Outbound network connections initiated by Graphite.exe to non-vendor infrastructure

Detection Strategies

Monitor process lineage for Ashlar-Vellum Graphite spawning interpreters, shells, or LOLBins
Alert on Graphite loading unsigned DLLs or writing executables to user-writable directories
Inspect email and web gateways for VC6 attachments from external senders
Correlate Graphite crash telemetry with subsequent suspicious process or network activity

Monitoring Recommendations

Enable command-line and module-load logging on workstations that run CAD software
Forward endpoint process telemetry to a centralized data lake for retrospective hunting across VC6 file opens
Track file-open events for the .vc6 extension and flag those originating from internet-zone locations

How to Mitigate CVE-2025-7981

Immediate Actions Required

Inventory all systems running Ashlar-Vellum Graphite and prioritize version 13.0.48 for remediation
Restrict opening of VC6 files to those received from trusted internal sources until a patch is applied
Train CAD users to validate the source of design files before opening them
Apply application allowlisting to constrain processes Graphite is permitted to spawn

Patch Information

Consult the Zero Day Initiative Advisory ZDI-25-634 and Ashlar-Vellum vendor communications for the latest fixed build. At publication of the NVD record, no vendor advisory URL was listed alongside CVE-2025-7981. Upgrade to the latest Graphite release as soon as the vendor publishes a patched version.

Workarounds

Block inbound VC6 file attachments at email and web gateways where business workflows allow
Open untrusted VC6 files only inside isolated virtual machines or sandboxed environments
Remove Graphite from systems where it is not actively required to reduce attack surface
Run Graphite under standard user accounts, never with administrative privileges

bash

# Example: block .vc6 attachments at an Exchange transport rule
New-TransportRule -Name "Block-VC6-Attachments" \
  -AttachmentExtensionMatchesWords "vc6" \
  -RejectMessageReasonText "VC6 files are blocked pending CVE-2025-7981 remediation"