CVE-2023-39427: 
NixOS vulnerability analysis and mitigation

In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share version prior to v12 SP2 Build (1204.200), a vulnerability was identified where the affected applications lack proper validation of user-supplied data when parsing XE files. The vulnerability, tracked as CVE-2023-39427, was discovered and reported by Michael Heinzl to CISA (CISA Advisory).

The vulnerability is classified as an Out-of-bounds Write (CWE-787) issue. It has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Additionally, a CVSS v4.0 score of 8.4 has been calculated with the vector string CVSS4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (CISA Advisory).

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code in the context of the current process (CISA Advisory).

The vulnerability requires local access and user interaction to be exploited. No known public exploitation specifically targeting this vulnerability has been reported to CISA at the time of advisory publication (CISA Advisory).

Ashlar-Vellum recommends users update to the latest version for Cobalt, Xenon, Lithium, and Argon by installing v12 SP12 Alpha Build (1204.200) (Jan 22, 2025). Additionally, users should only open files from trusted sources (CISA Advisory).