CVE-2025-7988: Ashlar Graphite RCE Vulnerability

CVE-2025-7988 Overview

CVE-2025-7988 is an out-of-bounds write vulnerability in Ashlar-Vellum Graphite, a computer-aided design (CAD) application. The flaw resides in the parser responsible for handling VC6 files. Attackers can exploit the issue by tricking a user into opening a crafted VC6 file or visiting a malicious page that delivers one. Successful exploitation leads to arbitrary code execution in the context of the current user process. The Zero Day Initiative tracked this issue as ZDI-CAN-25862 and published it as advisory ZDI-25-644. The vulnerability maps to [CWE-787] Out-of-Bounds Write.

Critical Impact
A crafted VC6 file opened in Ashlar-Vellum Graphite allows attackers to execute arbitrary code with the privileges of the user running the application.

Affected Products

Ashlar-Vellum Graphite 13.0
Ashlar-Vellum Graphite VC6 file parser component
Workstations using Graphite for CAD design workflows

Discovery Timeline

2025-09-17 - CVE-2025-7988 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7988

Vulnerability Analysis

The vulnerability exists in the VC6 file parsing logic inside Ashlar-Vellum Graphite. The parser does not properly validate user-supplied data describing structures within the VC6 file. As a result, the application writes data past the end of an allocated buffer in memory. This corrupts adjacent memory regions and provides an exploitation primitive that attackers can convert into arbitrary code execution.

Exploitation requires user interaction. The target must open a malicious VC6 file or visit a page that delivers such a file. Because Graphite typically runs with the privileges of the interactive user, successful exploitation yields code execution at that privilege level. The attack vector is local, but social engineering through email attachments, design file sharing, or compromised vendor portals makes delivery practical.

Root Cause

The root cause is missing bounds validation during deserialization of VC6 file structures. The parser trusts size or offset fields embedded in the file and uses them to control write operations into a fixed-size buffer. Crafted values exceed buffer capacity and cause a linear out-of-bounds write [CWE-787]. Memory corruption of this type generally allows attackers to overwrite function pointers, virtual table pointers, or return addresses.

Attack Vector

An attacker constructs a malformed VC6 file containing data that triggers the out-of-bounds write. The file is delivered through email, file-sharing services, malicious websites, or supply-chain CAD asset libraries. When a user opens the file in Graphite, the parser processes the malformed structures and corrupts process memory. The attacker chains the primitive with traditional exploitation techniques such as heap grooming or control-flow hijacking to execute shellcode. See the Zero Day Initiative Advisory ZDI-25-644 for additional technical context.

Detection Methods for CVE-2025-7988

Indicators of Compromise

Unexpected child processes spawned by Graphite.exe such as cmd.exe, powershell.exe, or rundll32.exe
Crashes or abnormal terminations of Graphite.exe correlated with VC6 file open events
VC6 files arriving from untrusted email senders, external file shares, or unknown CAD asset repositories
Outbound network connections originating from the Graphite process shortly after file open

Detection Strategies

Monitor process lineage for Graphite spawning shells, scripting hosts, or living-off-the-land binaries
Inspect VC6 files at the email and web proxy layers for anomalous structure sizes or malformed headers
Enable Windows Error Reporting and crash telemetry collection to surface exploitation attempts that fail
Apply behavioral identification rules that flag memory corruption patterns in CAD applications

Monitoring Recommendations

Track file open events for .vc6 extensions across endpoints running Graphite
Alert on Graphite processes loading unusual modules or allocating executable memory regions
Correlate endpoint identification telemetry with email gateway logs to trace malicious file delivery

How to Mitigate CVE-2025-7988

Immediate Actions Required

Restrict opening of VC6 files to those originating from trusted internal sources until a vendor patch is applied
Educate CAD users on the risk of opening Graphite project files received from external or unverified senders
Run Graphite under least-privilege user accounts to limit the impact of code execution
Apply application allowlisting to prevent Graphite from launching scripting or shell binaries

Patch Information

No vendor advisory URL is listed in the NVD record at publication time. Users should monitor the Ashlar-Vellum vendor channels and the Zero Day Initiative Advisory ZDI-25-644 for an official patch covering Graphite 13.0 and earlier affected builds.

Workarounds

Block inbound .vc6 attachments at the email gateway and web proxy
Use a sandboxed virtual machine or isolated workstation to open VC6 files received from external parties
Disable file association handlers that automatically open VC6 files when downloaded
Enable operating-system exploit mitigations such as Data Execution Prevention (DEP) and Control Flow Guard (CFG) for Graphite.exe

bash

# Example: block .vc6 file execution association on Windows via Group Policy preference
# Remove the user-level file association for .vc6 to require explicit application launch
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vc6" /f