Zetlyn
GitHubGet started

Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attacke…

cve CVE-2025-7981 1 source, 1 claim · Watch

NVD writes:
Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process… the claim
Vendor
Ashlar-Vellum NVD
Product
Graphite NVD
CWE
CWE-457 NVD

How far exploitation has got

  1. No public code known
  2. Proof of concept
  3. Proof of concept, verified
  4. A Metasploit module
  5. Exploited in the wild
  6. Used in ransomware campaigns

Timeline

2025-09-17first spoke of it: Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25475.NVD

Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25475.

What it is to other things

affectsashlar/graphite
NVD
made_byashlar
NVD

In words only, so not counted until a person confirms one:

made_byashlar_vellum
NVD says “Ashlar-Vellum”
affectsashlar_vellum/graphite
NVD says “Ashlar-Vellum · Graphite”
Every value, with what each source said and its receipt
PropertySourceSaidMeans here
Automatable
automatable
NVDno
At least one of those steps needs a person.
receipt
Source
NVD
Its words
no
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].automatable
Said since
2026-10-06 11:54 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 11:54 UTCno
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unknown",
            "product": "Graphite",
            "vendor": "Ashlar-Vellum",
            "versions": [
              {
                "status": "affected",
                "version": "13_SE_13048"
              }
            ]
          }
        ],
        "source": "zdi-disclosures@trendmicro.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:ashlar:graphite:13.0.48:*:*:*:*:*:*:*",
                "matchCriteriaId": "1D5591DA-62EF-4A3D-8CC4-35767964F951",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25475."
      },
      {
        "lang": "es",
        "value": "Vulnerabilidad de ejecución remota de código por variable no inicializada en el análisis de archivos VC6 de Ashlar-Vellum Graphite. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Ashlar-Vellum Graphite. Se requiere interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\n\nLa falla específica reside en el análisis de archivos VC6. El problema se debe a la falta de inicialización adecuada de la memoria antes de acceder a ella. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Fue ZDI-CAN-25475."
      }
    ],
    "id": "CVE-2025-7981",
    "lastModified": "2026-09-26T00:10:00.127",
    "metrics": {
      "cvssMetricV30": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "zdi-disclosures@trendmicro.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-7981",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-18T13:58:09.191157Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-17T21:15:39.227",
    "references": [
      {
        "source": "zdi-disclosures@trendmicro.com",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-634/"
      }
    ],
    "sourceIdentifier": "zdi-disclosures@trendmicro.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-457"
          }
        ],
        "source": "zdi-disclosures@trendmicro.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CWE
cwe
NVDCWE-457
receipt
Source
NVD
Its words
CWE-457
Read by
field:cve.weaknesses[].description[].value
Said since
2026-10-06 11:54 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 11:54 UTCCWE-457
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unknown",
            "product": "Graphite",
            "vendor": "Ashlar-Vellum",
            "versions": [
              {
                "status": "affected",
                "version": "13_SE_13048"
              }
            ]
          }
        ],
        "source": "zdi-disclosures@trendmicro.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:ashlar:graphite:13.0.48:*:*:*:*:*:*:*",
                "matchCriteriaId": "1D5591DA-62EF-4A3D-8CC4-35767964F951",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25475."
      },
      {
        "lang": "es",
        "value": "Vulnerabilidad de ejecución remota de código por variable no inicializada en el análisis de archivos VC6 de Ashlar-Vellum Graphite. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Ashlar-Vellum Graphite. Se requiere interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\n\nLa falla específica reside en el análisis de archivos VC6. El problema se debe a la falta de inicialización adecuada de la memoria antes de acceder a ella. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Fue ZDI-CAN-25475."
      }
    ],
    "id": "CVE-2025-7981",
    "lastModified": "2026-09-26T00:10:00.127",
    "metrics": {
      "cvssMetricV30": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "zdi-disclosures@trendmicro.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-7981",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-18T13:58:09.191157Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-17T21:15:39.227",
    "references": [
      {
        "source": "zdi-disclosures@trendmicro.com",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-634/"
      }
    ],
    "sourceIdentifier": "zdi-disclosures@trendmicro.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-457"
          }
        ],
        "source": "zdi-disclosures@trendmicro.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Exploitation
exploitation
NVDnone
No evidence of exploitation, and no public proof of concept.
receipt
Source
NVD
Its words
none
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].exploitation
Said since
2026-10-06 11:54 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 11:54 UTCnone
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unknown",
            "product": "Graphite",
            "vendor": "Ashlar-Vellum",
            "versions": [
              {
                "status": "affected",
                "version": "13_SE_13048"
              }
            ]
          }
        ],
        "source": "zdi-disclosures@trendmicro.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:ashlar:graphite:13.0.48:*:*:*:*:*:*:*",
                "matchCriteriaId": "1D5591DA-62EF-4A3D-8CC4-35767964F951",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25475."
      },
      {
        "lang": "es",
        "value": "Vulnerabilidad de ejecución remota de código por variable no inicializada en el análisis de archivos VC6 de Ashlar-Vellum Graphite. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Ashlar-Vellum Graphite. Se requiere interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\n\nLa falla específica reside en el análisis de archivos VC6. El problema se debe a la falta de inicialización adecuada de la memoria antes de acceder a ella. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Fue ZDI-CAN-25475."
      }
    ],
    "id": "CVE-2025-7981",
    "lastModified": "2026-09-26T00:10:00.127",
    "metrics": {
      "cvssMetricV30": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "zdi-disclosures@trendmicro.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-7981",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-18T13:58:09.191157Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-17T21:15:39.227",
    "references": [
      {
        "source": "zdi-disclosures@trendmicro.com",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-634/"
      }
    ],
    "sourceIdentifier": "zdi-disclosures@trendmicro.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-457"
          }
        ],
        "source": "zdi-disclosures@trendmicro.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Product
product
NVDGraphite
receipt
Source
NVD
Its words
Graphite
Read by
field:cve.affected[].affectedData[].product
Said since
2026-09-29 17:49 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-09-29 17:49 UTCGraphite
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unknown",
            "product": "Graphite",
            "vendor": "Ashlar-Vellum",
            "versions": [
              {
                "status": "affected",
                "version": "13_SE_13048"
              }
            ]
          }
        ],
        "source": "zdi-disclosures@trendmicro.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:ashlar:graphite:13.0.48:*:*:*:*:*:*:*",
                "matchCriteriaId": "1D5591DA-62EF-4A3D-8CC4-35767964F951",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25475."
      },
      {
        "lang": "es",
        "value": "Vulnerabilidad de ejecución remota de código por variable no inicializada en el análisis de archivos VC6 de Ashlar-Vellum Graphite. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Ashlar-Vellum Graphite. Se requiere interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\n\nLa falla específica reside en el análisis de archivos VC6. El problema se debe a la falta de inicialización adecuada de la memoria antes de acceder a ella. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Fue ZDI-CAN-25475."
      }
    ],
    "id": "CVE-2025-7981",
    "lastModified": "2026-09-26T00:10:00.127",
    "metrics": {
      "cvssMetricV30": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "zdi-disclosures@trendmicro.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-7981",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-18T13:58:09.191157Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-17T21:15:39.227",
    "references": [
      {
        "source": "zdi-disclosures@trendmicro.com",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-634/"
      }
    ],
    "sourceIdentifier": "zdi-disclosures@trendmicro.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-457"
          }
        ],
        "source": "zdi-disclosures@trendmicro.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Status
status
NVDAnalyzed
receipt
Source
NVD
Its words
Analyzed
Read by
field:cve.vulnStatus
Said since
2026-09-29 09:45 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unknown",
            "product": "Graphite",
            "vendor": "Ashlar-Vellum",
            "versions": [
              {
                "status": "affected",
                "version": "13_SE_13048"
              }
            ]
          }
        ],
        "source": "zdi-disclosures@trendmicro.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:ashlar:graphite:13.0.48:*:*:*:*:*:*:*",
                "matchCriteriaId": "1D5591DA-62EF-4A3D-8CC4-35767964F951",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25475."
      },
      {
        "lang": "es",
        "value": "Vulnerabilidad de ejecución remota de código por variable no inicializada en el análisis de archivos VC6 de Ashlar-Vellum Graphite. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Ashlar-Vellum Graphite. Se requiere interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\n\nLa falla específica reside en el análisis de archivos VC6. El problema se debe a la falta de inicialización adecuada de la memoria antes de acceder a ella. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Fue ZDI-CAN-25475."
      }
    ],
    "id": "CVE-2025-7981",
    "lastModified": "2026-09-26T00:10:00.127",
    "metrics": {
      "cvssMetricV30": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "zdi-disclosures@trendmicro.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-7981",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-18T13:58:09.191157Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-17T21:15:39.227",
    "references": [
      {
        "source": "zdi-disclosures@trendmicro.com",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-634/"
      }
    ],
    "sourceIdentifier": "zdi-disclosures@trendmicro.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-457"
          }
        ],
        "source": "zdi-disclosures@trendmicro.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Technical impact
technical_impact
NVDtotal
The attacker gains full control of the component, or all of its information.
receipt
Source
NVD
Its words
total
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].technicalImpact
Said since
2026-10-06 11:54 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 11:54 UTCtotal
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unknown",
            "product": "Graphite",
            "vendor": "Ashlar-Vellum",
            "versions": [
              {
                "status": "affected",
                "version": "13_SE_13048"
              }
            ]
          }
        ],
        "source": "zdi-disclosures@trendmicro.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:ashlar:graphite:13.0.48:*:*:*:*:*:*:*",
                "matchCriteriaId": "1D5591DA-62EF-4A3D-8CC4-35767964F951",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25475."
      },
      {
        "lang": "es",
        "value": "Vulnerabilidad de ejecución remota de código por variable no inicializada en el análisis de archivos VC6 de Ashlar-Vellum Graphite. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Ashlar-Vellum Graphite. Se requiere interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\n\nLa falla específica reside en el análisis de archivos VC6. El problema se debe a la falta de inicialización adecuada de la memoria antes de acceder a ella. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Fue ZDI-CAN-25475."
      }
    ],
    "id": "CVE-2025-7981",
    "lastModified": "2026-09-26T00:10:00.127",
    "metrics": {
      "cvssMetricV30": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "zdi-disclosures@trendmicro.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-7981",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-18T13:58:09.191157Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-17T21:15:39.227",
    "references": [
      {
        "source": "zdi-disclosures@trendmicro.com",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-634/"
      }
    ],
    "sourceIdentifier": "zdi-disclosures@trendmicro.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-457"
          }
        ],
        "source": "zdi-disclosures@trendmicro.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Vendor
vendor
NVDAshlar-Vellum
receipt
Source
NVD
Its words
Ashlar-Vellum
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-09-29 17:49 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-09-29 17:49 UTCAshlar-Vellum
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unknown",
            "product": "Graphite",
            "vendor": "Ashlar-Vellum",
            "versions": [
              {
                "status": "affected",
                "version": "13_SE_13048"
              }
            ]
          }
        ],
        "source": "zdi-disclosures@trendmicro.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:ashlar:graphite:13.0.48:*:*:*:*:*:*:*",
                "matchCriteriaId": "1D5591DA-62EF-4A3D-8CC4-35767964F951",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25475."
      },
      {
        "lang": "es",
        "value": "Vulnerabilidad de ejecución remota de código por variable no inicializada en el análisis de archivos VC6 de Ashlar-Vellum Graphite. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Ashlar-Vellum Graphite. Se requiere interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\n\nLa falla específica reside en el análisis de archivos VC6. El problema se debe a la falta de inicialización adecuada de la memoria antes de acceder a ella. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Fue ZDI-CAN-25475."
      }
    ],
    "id": "CVE-2025-7981",
    "lastModified": "2026-09-26T00:10:00.127",
    "metrics": {
      "cvssMetricV30": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "zdi-disclosures@trendmicro.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-7981",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-18T13:58:09.191157Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-17T21:15:39.227",
    "references": [
      {
        "source": "zdi-disclosures@trendmicro.com",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-634/"
      }
    ],
    "sourceIdentifier": "zdi-disclosures@trendmicro.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-457"
          }
        ],
        "source": "zdi-disclosures@trendmicro.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Every claim, by kind

vulnerability

Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25475.
zetlyn/cve-nvd · 2025-09-17
automatable no cwe CWE-457 exploitation none product Graphite status Analyzed technical_impact total vendor Ashlar-Vellum source