Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

CVE-2023-34307

What is CVE-2023-34307?

A significant vulnerability affecting Ashlar-Vellum Graphite relates to improper validation in the parsing of VC6 files. This flaw allows remote attackers to execute arbitrary code on compromised systems, but it necessitates user interaction; the user must open a malicious VC6 file or visit a harmful web page. The vulnerability arises because the application fails to adequately verify user-supplied data, resulting in a potential buffer overrun, which an attacker can exploit to execute code within the context of the application.

References