CVE-2025-7983: 
NixOS vulnerability analysis and mitigation

Ashlar-Vellum Graphite version 13.0.48 contains a heap-based buffer overflow vulnerability in the VC6 file parsing functionality (CVE-2025-7983). The vulnerability was discovered by Rocco Calvi of TecSecurity and was reported to Zero Day Initiative on November 13, 2024. The issue was publicly disclosed on July 22, 2025, after attempts to coordinate with the vendor (Zero Day Initiative).

The vulnerability exists within the parsing of VC6 files and stems from the lack of proper validation of user-supplied data length before copying it to a heap-based buffer. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (High) with the vector string CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue has been classified as CWE-122 (Heap-based Buffer Overflow) (Zero Day Initiative).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process on affected installations of Ashlar-Vellum Graphite. The high CVSS score indicates potential severe impacts on system confidentiality, integrity, and availability (Zero Day Initiative).

Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the product. As of the disclosure date, no vendor patch was available (Zero Day Initiative).