Ashlar-Vellum Cobalt CVE-2025-11463
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted XE file to victim
-
DeliveryVictim opens file in Cobalt
-
ExploitInteger overflow undersizes buffer allocation
-
ExecutionHeap/buffer corruption during parse
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a maliciously crafted XE file (or visit a page that delivers one) in Ashlar-Vellum Cobalt - the trigger is specifically the XE file-parsing routine, which fails to validate user-supplied data before an integer-overflow-driven buffer allocation. Limiting factors: this is strictly LOCAL (AV:L), there is no network-reachable attack surface, and mandatory user interaction (UI:R) means a user must be socially engineered into opening attacker-supplied content; code executes only with the privileges of the user running Cobalt, with no scope change to other components. |
| Impact | Multiple signals converge on this being a genuine but NON-urgent vulnerability. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a classic file-format memory-corruption bug: the 'network' label is absent - exploitation is LOCAL and requires user interaction (the victim must open a malicious XE file or visit a malicious page that serves one). It is NOT a remotely-reachable service flaw despite the 'Remote Code Execution' name. EPSS is very low at 0.20% (9th percentile), indicating low statistical likelihood of exploitation in the near term. The vulnerability is NOT in CISA KEV (no confirmed active exploitation) and no public proof-of-concept is referenced - only the ZDI advisory (ZDI-25-954, ZDI-CAN-26626). No SSVC decision data is provided in the input. Signals are mutually consistent: a high local-impact bug in a niche CAD product with no exploitation evidence. This is a real vulnerability worth patching for Ashlar-Vellum Cobalt users, but it is a high-CVSS / low-real-world-urgency issue rather than an emergency - its exploitation depends entirely on social-engineering a specific user into opening a crafted file. |
| Exploit ScenarioDerived | An attacker crafts a malicious XE file that triggers an integer overflow during Cobalt's file parsing, causing an undersized buffer allocation and subsequent memory corruption. The attacker delivers it via email, a shared project file, or a malicious web page, and when an engineer opens the file in Ashlar-Vellum Cobalt, arbitrary code runs in the context of that user's process. No public exploit code is referenced, and user interaction (opening the file) is mandatory per the CVSS UI:R metric. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Integer overflow in the XE file-parsing routine of Ashlar-Vellum Cobalt 12.2.1204.97 lets an attacker execute arbitrary code in the context of the running process when a user opens a maliciously crafted XE file or visits a page that delivers one. Because the flaw is reached through local file parsing (AV:L) and requires the victim to be socially engineered into opening attacker-supplied content (UI:R), it is a genuine but non-urgent risk: there is no network-reachable attack surface independent of user action, and code runs only with the privileges of the user running Cobalt, with no scope change. No public exploit code has been identified at time of analysis, the vulnerability is not confirmed actively exploited (no CISA KEV listing), and EPSS is low at 0.20% (9th percentile), reflecting limited observed exploitation activity.
RemediationAI
No vendor-released patch or fixed version is identified in the available data; the only reference is the Zero Day Initiative advisory ZDI-25-954 (https://www.zerodayinitiative.com/advisories/ZDI-25-954/), which should be monitored for a vendor fix and for any updated affected-version list. Until a patched Cobalt build is published, apply compensating controls that target the delivery path: block or quarantine .xe (and related Ashlar/Cobalt document) attachments at email and web gateways and strip them from untrusted downloads, accepting that this degrades legitimate CAD file sharing and that renamed or archived files can bypass extension filtering. Enforce Mark-of-the-Web/attachment policy so that files arriving from the internet trigger Protected View or an open-file warning, and train users not to open XE documents from unverified sources - the trade-off is that these prompts are advisory and can be dismissed by a determined user. Run Cobalt as a standard, non-administrative user and, where practical, inside a sandboxed VM or application-isolation container so that successful exploitation yields only low-privilege access on a disposable host, at the cost of reduced performance and added workflow overhead. Enable Windows Exploit Protection mitigations (DEP, ASLR, CFG) for the Cobalt executable to raise the difficulty of converting the out-of-bounds write into reliable code execution, while recognizing these are hardening measures and not a substitute for a vendor patch.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-190 integer overflow in the parser that reads XE files, Ashlar-Vellum Cobalt's 3D modeling/CAD document format. When the parser processes user-supplied length or count fields from the XE file, the value is used in an arithmetic size computation without validation; the result overflows and wraps to an unexpectedly small number, so the subsequent buffer allocation is undersized relative to the data later copied into it. That mismatch turns the integer overflow into an out-of-bounds memory write, which an attacker can steer toward code execution inside the Cobalt process. The affected build in the CPE data is cpe:2.3:a:ashlar:cobalt:12.2.1204.97. The issue was reported by Trend Micro's Zero Day Initiative as ZDI-CAN-26626 and published as advisory ZDI-25-954; the CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H describes an unauthenticated local-vector attack that still depends on a user opening the crafted file, with high confidentiality, integrity, and availability impact confined to the Cobalt process.
Know when Cobalt gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a user (AV:L, UI:R); no prior privileges or authentication needed (PR:N); code runs as the current user yielding full C/I/A impact within that process.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Ashlar-Vellum Cobalt XE File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26626.
Executive ViewAI
Ashlar-Vellum Cobalt 12.2.1204.97, a 3D modeling and design application used by engineering and design staff, carries a high-severity memory-safety flaw that allows a maliciously crafted XE file to run attacker code on the workstation that opens it. Exploitation depends on an employee opening a crafted file or visiting a page that delivers one, so exposure is concentrated in teams that routinely exchange XE files with clients, partners, and external parties. Leadership should care because a successful attack hands an intruder the user's endpoint, credentials, and access to shared design repositories, but with no vendor patch yet, low observed exploitation activity, and no public exploit identified at time of analysis, this is a manageable, process-driven risk rather than a crisis.
No vendor-released patch identified at time of analysis. Interim mitigations: block or quarantine XE files from external and untrusted sources at the email and web gateway, run Cobalt in a non-administrative user context to limit what attacker code can reach, review unknown-provenance XE files in a sandboxed VM or isolated host, maintain EDR monitoring for Cobalt spawning unexpected child processes, and reinforce user awareness training against opening XE files from unsolicited sources.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)NVD
An Out-of-Bounds Write vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share version
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of
A Heap-based Buffer Overflow vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of
Arbitrary code execution and information disclosure in the Ashlar-Vellum CAD/3D-modeling suite (Cobalt, Xenon, Argon, Li
Arbitrary code execution and information disclosure in Ashlar-Vellum's CAD suite (Cobalt, Xenon, Argon, Lithium, and Cob
Arbitrary code execution in the Ashlar-Vellum CAD suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.
Parsing a maliciously crafted CO design file in Ashlar-Vellum Cobalt 12.2.1204.97 (the version identified in the CPE dat
Heap-based buffer overflow in Ashlar-Vellum Cobalt 12.2.1204.97 allows attackers to execute arbitrary code when a user o
Heap-based buffer overflow in Ashlar-Vellum Cobalt during parsing of VS drawing files allows an attacker to execute arbi
Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7
Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS
GitHub PoC
Exploit-DB