CVE-2025-7989

Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required in that the target must visit a malicious page or open a malicious file.

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing XE files. It results from lack of validation of user-supplied data, leading to an out-of-bounds read past the end of an allocated data structure. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing XE files. It results from lack of validation of user-supplied data, leading to a type confusion condition. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing XE files. It results from lack of validation of user-supplied data, leading to an out-of-bounds read past the end of an allocated data structure. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing CO files. It results from lack of validation of user-supplied data, leading to an out-of-bounds read past the end of an allocated data structure. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing CO files. It results from lack of validation of user-supplied data, leading to a type confusion condition. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing CO files. It results from lack of validation of user-supplied data, leading to a memory corruption condition. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing LI files. It results from lack of validation of user-supplied data, leading to a type confusion condition. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing AR files. It results from lack of validation of user-supplied data, leading to a type confusion condition. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing CO files. It results from lack of validation of user-supplied data, leading to an out-of-bounds write past the end of an allocated data structure. Requires user interaction (visiting a malicious page or opening a malicious file).