Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

CVE-2023-34308

What is CVE-2023-34308?

The vulnerability arises in Ashlar-Vellum Graphite due to inadequate validation when parsing VC6 files. This flaw allows remote attackers to execute arbitrary code on affected installations by compelling a user to visit a malicious webpage or open a compromised VC6 file. The vulnerability exploits the inadequacies of user-supplied data handling, resulting in a write past the end of an allocated buffer. By leveraging this issue, attackers can execute code within the context of the current process, posing a significant risk to the integrity and confidentiality of the system.

References