CVE-2023-39936 (Ashlar-Vellum CAD RCE): Are Your Design Files Exposed? India SMB Guide

Originally reported by NIST NVD

There's a consistent pattern with vulnerabilities in niche software—tools that aren't household names—they slip through the cracks. Teams focus on the big vendors and the specialist tools go unwatched. Teams focus on securing Microsoft, Adobe, and SAP. But what about the specialized CAD software your engineering team uses daily? What about the design tools your architects depend on?

That's exactly the gap CVE-2023-39936 exposes. And it's why I built Bachao.AI—to make sure Indian SMBs don't have to wait for a major breach to discover these blind spots.

Let me walk you through what happened, why it matters for your business, and exactly how to protect yourself.

What Happened

Ashlar-Vellum Graphite, a professional CAD (Computer-Aided Design) software used by architects, engineers, and designers, contains a critical vulnerability in versions up to v13.0.48. The vulnerability exists in how the application parses VC6 files—a proprietary vector graphics format used internally by Graphite.

Here's the technical issue: the application fails to properly validate user-supplied data when reading VC6 files. This means if you open a maliciously crafted VC6 file, the parser attempts to read data from memory locations it shouldn't access—an "out-of-bounds read." But here's where it gets dangerous: attackers can exploit this flaw to execute arbitrary code with the privileges of the user running Graphite.

In practical terms: if your engineer opens a suspicious design file sent via email or downloaded from an untrusted source, an attacker gains full control of their workstation. From there, they can:

1. Steal intellectual property: Access your design files, CAD blueprints, and proprietary schematics
2. Plant backdoors: Install persistent malware for long-term access
3. Lateral movement: Use the compromised machine to attack your internal network
4. Data exfiltration: Copy sensitive project files, client data, and business plans

Why This Matters for Indian Businesses

From the security assessments we run for Indian SMBs, one thing is clear: design and engineering firms are particularly vulnerable to this type of attack.

Here's why:

1. Intellectual Property Risk Under DPDP Act

India's Digital Personal Data Protection Act (2023) doesn't just cover personal data—it covers any sensitive information processed digitally. If your CAD files contain customer data, employee information, or personal details embedded in designs, a breach triggered by CVE-2023-39936 means you're liable for DPDP compliance failures.

The penalties? Up to ₹250 crore per contravention under the DPDP Act 2023. For an SMB, even a fraction of that is devastating.

2. CERT-In Incident Reporting Mandate

If an attacker exploits this vulnerability to breach your systems, you have 6 hours to report it to CERT-In (Indian Computer Emergency Response Team). Failing to report means additional penalties under the Information Technology Act, 2000.

But here's the catch: many SMBs don't even know they've been breached because they're not actively monitoring for these kinds of application-level vulnerabilities.

3. Supply Chain Risk

If you're a design consultancy working with larger clients, a breach in your systems could violate your client contracts. Manufacturing firms, construction companies, and tech startups all depend on design firms to keep their blueprints and specifications confidential. A single compromised design file could expose your client's entire product roadmap.

4. Niche Software, Ignored Patches

Unlike Microsoft or Adobe, Ashlar-Vellum doesn't have the same patch distribution infrastructure. Many Indian SMBs running older versions of Graphite might not even know an update exists—or they might delay patching because "it works fine now."

This is exactly the kind of vulnerability that sits unpatched for months, waiting to be exploited.

Technical Breakdown: How the Attack Works

Let me break down the attack flow so you understand exactly what's happening:

graph TD
    A["Attacker crafts malicious VC6 file"] -->|Embeds out-of-bounds
read payload| B["Sends file via email
to target user"]
    B -->|User opens file
in Graphite| C["Parser reads VC6 header
without validation"]
    C -->|Accesses invalid
memory address| D["Buffer overflow/
Memory corruption"]
    D -->|Executes shellcode
in process context| E["Arbitrary code execution
with user privileges"]
    E -->|Attacker gains
shell access| F["Data theft, lateral
movement, persistence"]

The Root Cause: Insufficient Input Validation

VC6 files have a specific structure. A legitimate VC6 file might look like this:

[VC6_HEADER]
Version: 1.0
ObjectCount: 42
DataSize: 4096
[OBJECT_1]
Type: POLYGON
Vertices: 8
Coordinates: [x1,y1], [x2,y2], ...

Graphite's parser reads the header and trusts the values. But what if an attacker modifies ObjectCount to 9999 or DataSize to a negative number?

The vulnerable code probably looks something like this (pseudocode):

// Vulnerable parsing logic
int objectCount = readIntFromFile(file);
int dataSize = readIntFromFile(file);

// No validation!
char* buffer = malloc(dataSize);
for (int i = 0; i < objectCount; i++) {
    // Reads beyond allocated buffer if objectCount > actual objects
    readObject(file, buffer + (i * sizeof(Object)));
}

If objectCount is artificially inflated, the loop reads beyond the buffer boundaries, accessing memory it shouldn't. An attacker can craft the VC6 file so that this out-of-bounds read overwrites critical function pointers or return addresses, leading to arbitrary code execution.

Attack Vector: Social Engineering + Malicious File

The most common attack scenario:

1. Reconnaissance: Attacker identifies your company as a design firm (LinkedIn, company website, job postings)
2. Social engineering: Sends a spear-phishing email: "Hi, I'm from [Client Name]. Can you review this updated blueprint? See attached VC6 file."
3. Exploitation: Engineer opens the file thinking it's legitimate work
4. Compromise: Malicious VC6 file triggers the vulnerability, executing attacker's payload
5. Persistence: Attacker installs backdoor, steals files, monitors activity
6. Lateral movement: Uses compromised machine to access shared drives, databases, email servers

How to Protect Your Business

Now, let's talk solutions. Here's what you can do right now:

Step 1: Patch Immediately

Ashlar-Vellum has released patches for Graphite. Check your version:

On Windows:

REM Open Graphite and check Help > About
REM Or check the installation directory
dir "C:\Program Files\Ashlar-Vellum\Graphite\" | find "version"

On macOS:

# Check installed version
ls -la /Applications/Graphite.app/Contents/Info.plist
grep "CFBundleShortVersionString" /Applications/Graphite.app/Contents/Info.plist

Action: If you're running v13.0.48 or earlier, update immediately from Ashlar-Vellum's official website. Do not download from third-party sources.

Step 2: Implement File Validation

If you must work with VC6 files from external sources, validate them first:

#!/bin/bash
# Simple VC6 file validation script

VC6_FILE="$1"

# Check file signature (VC6 files should start with specific magic bytes)
HEADER=$(xxd -l 16 -p "$VC6_FILE")
echo "File header: $HEADER"

# Check file size (should be reasonable, not suspiciously small/large)
FILE_SIZE=$(stat -f%z "$VC6_FILE" 2>/dev/null || stat -c%s "$VC6_FILE")
echo "File size: $FILE_SIZE bytes"

# Warn if file size is unusual
if [ "$FILE_SIZE" -lt 100 ] || [ "$FILE_SIZE" -gt 1000000000 ]; then
    echo "WARNING: File size seems suspicious. Do not open in Graphite."
    exit 1
fi

echo "File appears valid. Safe to open."
exit 0

Usage:

bash validate_vc6.sh suspicious_file.vc6

Step 3: Disable File Auto-Opening

Configure Graphite to never auto-open files:

1. Open Graphite
2. Go to Preferences (or Settings on macOS)
3. Navigate to File Handling
4. Disable "Auto-open recent files"
5. Disable "Auto-open files on startup"

Step 4: Isolate Design Workstations

If possible, keep design machines on a separate network segment:

graph TD
    A["Corporate Network"] -->|Firewall| B["Design Workstation Network"]
    B -->|Limited egress| C["Internet"]
    A -->|No direct access| B
    B -->|File transfer
via USB/approved| A

This way, if a design machine is compromised, attackers can't immediately pivot to your main network.

Step 5: Monitor for Suspicious Activity

Set up basic file integrity monitoring:

On Windows (using built-in tools):

# Monitor for unexpected changes to VC6 files
Get-Item -Path "C:\Users\*\Documents\*.vc6" -Recurse | `
  Select-Object FullName, LastWriteTime | `
  Export-Csv -Path "C:\Security\vc6_baseline.csv" -NoTypeInformation

# Run weekly to detect unauthorized modifications
Get-Item -Path "C:\Users\*\Documents\*.vc6" -Recurse | `
  Select-Object FullName, LastWriteTime | `
  Compare-Object -ReferenceObject (Import-Csv "C:\Security\vc6_baseline.csv")

Step 6: Email Security

Block VC6 files at the email gateway:

Gmail (if using Google Workspace):

1. Go to Security > Advanced phishing and malware
2. Add .vc6 to Blocked file types

1. Exchange Admin Center > Mail flow > Rules
2. Create rule: "If attachment has extension .vc6, block message"

How Bachao.AI Would Have Prevented This

This is exactly why I built Bachao.AI—to catch these vulnerabilities before they become breaches. Here's how our platform would protect you:

VAPT Scan (Vulnerability Assessment & Penetration Testing)

1. What it does: Scans your entire IT infrastructure, including niche software like Graphite, for known vulnerabilities
2. How it catches CVE-2023-39936: Identifies all installed versions of Graphite, flags v13.0.48 and earlier as vulnerable, and recommends immediate patching
3. Cost: Free tier available; comprehensive scan starts at ₹1,999
4. Time to detect: Real-time scanning, results in 24-48 hours

Dark Web Monitoring

1. What it does: Monitors the dark web, paste sites, and hacking forums for stolen credentials and leaked data from your domain
2. How it helps: If a design file containing your company's data is stolen via CVE-2023-39936, we'll detect it being shared among attackers and alert you immediately
3. Cost: Included in premium plans
4. Time to detect: Within hours of data appearing on dark web

Incident Response (24/7 Breach Response)

1. What it does: Our security team responds to active breaches within 1 hour, conducts forensics, and handles CERT-In notification
2. How it helps: If an attacker exploits this vulnerability and gains access to your network, we contain the breach, identify what was stolen, and ensure you meet the CERT-In 6-hour reporting deadline
3. Cost: ₹5,000/month for 24/7 coverage
4. Time to respond: Under 1 hour

Security Training (Phishing Simulation)

1. What it does: Sends simulated phishing emails with malicious file attachments (in a safe, controlled way) to train employees
2. How it helps: Your team learns to identify suspicious VC6 files and malicious emails before opening them
3. Cost: ₹500 per employee per simulation
4. Results: 60-70% reduction in click-through rates after 3 months

Quick Checklist for Your Business

Use this checklist to assess your risk right now:

1. [ ] I've checked all workstations for Ashlar-Vellum Graphite
2. [ ] All instances are updated to v13.0.49 or later
3. [ ] VC6 files are blocked from email
4. [ ] Design team has received phishing awareness training
5. [ ] I have a process for validating files from external sources
6. [ ] My IT team is monitoring for unauthorized access to design files
7. [ ] I've documented who has access to sensitive CAD files
8. [ ] I have a backup of all critical design files (tested recovery)
9. [ ] I understand my DPDP Act and CERT-In reporting obligations
10. [ ] I have an incident response plan in place

What's Next?

CVE-2023-39936 is just one of hundreds of vulnerabilities that could affect your business. The reality is: most Indian SMBs don't have the resources to track every vulnerability in every tool they use.

That's why Bachao.AI exists.

We monitor vulnerabilities continuously, scan your infrastructure automatically, and alert you to risks before attackers exploit them. We also handle the compliance burden—DPDP Act readiness, CERT-In notifications, RBI guidelines, everything.

The best time to secure your business was yesterday. The second-best time is today.

Book your free security scan today → /#book-scan

Our team will review your current security posture, identify vulnerabilities like CVE-2023-39936, and give you a clear roadmap to fix them. No pressure, no sales pitch—just honest security guidance.

This article was written by the Bachao.AI research team. We analyze cybersecurity incidents daily to help Indian SMBs stay protected. If you have questions about this vulnerability or your security posture, reach out to us at security@bachao.ai.

Originally reported by NIST NVD

Written by Shouvik Mukherjee, Founder & CEO of Bachao.AI. Follow me on LinkedIn for daily cybersecurity insights for Indian businesses.

Am I Affected? Quick Version Check

Pull the version string from your design software's About menu or via the vendor's CLI. Compare it against the vendor's published advisory — every build below the fixed version inherits the flaw, regardless of whether the feature is enabled. If you run a mixed-version fleet (which most agencies do), assume the oldest installed build is your true exposure floor until you have evidence otherwise.

Detection: IOCs and Log Patterns

Look in application logs for anomalous file-open events that reference paths outside the user's project tree, especially network paths or temp-directory traversals. EDR/MDR rules should fire on unexpected child processes spawned by the design app (shells, scripting interpreters, or compression utilities). If you cannot see process-tree events, you are flying blind — that is itself a finding worth tracking until you have EDR coverage across creative endpoints.

Patch & Workaround Steps for SMBs

Push the vendor-supplied update via your endpoint management tool or, for un-managed fleets, send a one-line operator note with the version users must be on by end of week. If a patched build is not yet available for your edition, disable the affected file-handling feature and block inbound files of the relevant type at the email gateway. Document the workaround as a temporary control with an explicit removal date — temporary controls that don't get removed are how SMBs accumulate audit findings.

DPDP Reporting Obligation If Exploited

If you assess this CVE as having compromised personal data of Indian residents, the DPDP Act and Rules require breach notification to the Data Protection Board within the prescribed window, plus notification to affected data principals. The 72-hour clock starts when you become aware of the breach, not when you finish investigating it — your incident response playbook needs a draft notification template ready to go.

Run a Free Bachao.AI Scan for CVE-2023-39936

Our scanner detects vulnerable installations of common design and collaboration tools across your external attack surface, plus the misconfigurations that turn an unpatched binary into an exploitation chain. If you want a written, CERT-In-aligned snapshot of your exposure to this CVE and adjacent CVEs in the same class, book a free scan — the report covers detection, severity, and the exact remediation steps for your tech stack.