Ashlar-Vellum Cobalt CVE-2025-11465

Exploitation requires the victim to open or process a maliciously crafted CO (Cobalt) design file in Ashlar-Vellum Cobalt - the flaw is specifically in CO file parsing where the code fails to validate the existence of an object before operating on it. The primary limiting factors are: mandatory user interaction (UI:R - the target must actively open the malicious file or visit a page that serves it), a local attack vector (no network-service exposure; the attacker cannot reach the parser without delivering a file to the user), and execution confined to the privilege level of the user running Cobalt (non-elevated by default, no scope change S:U). Only installations of the affected product (version 12.2.1204.97 per the CPE) are impacted.

This is a genuinely significant but context-dependent client-side risk rather than an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a local attack vector requiring user interaction with high impact to confidentiality, integrity, and availability - consistent with a file-parsing use-after-free (CWE-416) that executes code in the context of the current user who opens a malicious CO file. The 'remote attackers' language in the ZDI description refers to remote delivery of a malicious file/page, not network-level exploitation; the vector correctly remains AV:L because a victim must open the file locally. Exploitation signals are weak: EPSS is only 0.21% (11th percentile), the CVE is NOT on CISA KEV, and no public exploit code is identified at time of analysis - so there is no public exploit identified at time of analysis and no evidence of active exploitation. These signals align coherently (low-prevalence niche CAD product + no KEV + low EPSS = low likelihood of widespread opportunistic exploitation). No SSVC decision data was provided in the input. Net: prioritize patching for organizations running Ashlar-Vellum Cobalt, but this is not a mass-exploitation threat; the realistic risk is targeted spear-phishing against CAD/engineering users.

An attacker crafts a malicious CO file and delivers it via email or a malicious web page to an engineering user running Ashlar-Vellum Cobalt. When the victim opens the file, the CO parser operates on an object that was never validated as existing, triggering a use-after-free that the attacker leverages to execute arbitrary code in the context of the current user. No public proof-of-concept exploit is identified at time of analysis.