Cobalt
Monthly
Heap-based buffer overflow in Ashlar-Vellum Cobalt during parsing of VS drawing files allows an attacker to execute arbitrary code in the context of the victim's process. Exploitation requires the target to open a crafted VS file (user interaction), and no authentication or server-side access is needed because the flaw sits in the file parser. No public exploit code has been identified and the issue is not listed in CISA KEV; the vendor advisory is ZDI-26-587.
Arbitrary code execution and information disclosure in the Ashlar-Vellum CAD/3D-modeling suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.1204.216 and prior) can be triggered when the application parses a maliciously crafted VC6 file. The flaw is an out-of-bounds read (CWE-125) reached through the file-import path, giving an attacker who convinces a user to open a booby-trapped file the ability to leak memory or run code in the context of the victim. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), consistent with the local, user-interaction-dependent attack model reported by CISA ICS-CERT.
Arbitrary code execution and information disclosure in Ashlar-Vellum's CAD suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.1204.216 and prior) is possible when the application parses a specially crafted VC6 file, driven by an out-of-bounds read (CWE-125). An attacker who convinces a user to open a malicious VC6 file can read out-of-bounds memory to leak data or steer execution toward running arbitrary code in the context of the user. There is no public exploit identified at time of analysis, the EPSS score is negligible (0.01%), and CISA's SSVC framework rates exploitation as 'none' but technical impact as 'total'.
Arbitrary code execution in the Ashlar-Vellum CAD suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.1204.216 and prior) occurs when the application parses a maliciously crafted VC6 file, triggering an out-of-bounds write. An attacker must convince a user to open a booby-trapped drawing file, after which code runs in the context of the victim's user account. There is no public exploit identified at time of analysis, and the EPSS probability is negligible (0.01%), consistent with the CISA/ICS-CERT SSVC assessment of no known exploitation.
A Heap-based Buffer Overflow vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.207 and prior that could allow an attacker to disclose. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An Out-of-Bounds Write vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.207 and prior that could allow an attacker to disclose information. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Parsing a maliciously crafted CO design file in Ashlar-Vellum Cobalt 12.2.1204.97 (the version identified in the CPE data) can trigger a use-after-free that allows arbitrary code execution in the context of the user running the application. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) shows the flaw is reachable without authentication (PR:N) but is not remotely reachable as a service: it is a local-vector issue that requires mandatory user interaction, meaning the victim must open the file or visit a page that serves it, and any code runs at the privileges of the current, normally non-elevated user (no scope change). Reported through Trend Micro's Zero Day Initiative as ZDI-CAN-26631 / ZDI-25-956, the issue has no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is low at 0.21% (11th percentile), consistent with a targeted, file-delivery-dependent client-side bug rather than a mass-exploited one.
Heap-based buffer overflow in Ashlar-Vellum Cobalt 12.2.1204.97 allows attackers to execute arbitrary code when a user opens a malicious CO file. The vulnerability requires user interaction (UI:R) and executes code in the context of the current user process; despite the 'remote code execution' label, it is not network-reachable without a lure. No public exploit has been identified at time of analysis, and EPSS indicates a low likelihood of exploitation (0.21%).
Integer overflow in the XE file-parsing routine of Ashlar-Vellum Cobalt 12.2.1204.97 lets an attacker execute arbitrary code in the context of the running process when a user opens a maliciously crafted XE file or visits a page that delivers one. Because the flaw is reached through local file parsing (AV:L) and requires the victim to be socially engineered into opening attacker-supplied content (UI:R), it is a genuine but non-urgent risk: there is no network-reachable attack surface independent of user action, and code runs only with the privileges of the user running Cobalt, with no scope change. No public exploit code has been identified at time of analysis, the vulnerability is not confirmed actively exploited (no CISA KEV listing), and EPSS is low at 0.20% (9th percentile), reflecting limited observed exploitation activity.
Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt CO File Parsing Memory Corruption Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt LI File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt AR File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt LI File Parsing Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt VC6 File Parsing Integer Overflow Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt AR File Parsing Uninitialized Variable Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt LI File Parsing Integer Overflow Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt LI File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing XE files. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing VC6 files. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing CO files. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing AR files. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of user-supplied data when parsing CO files. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of user-supplied data when parsing XE files. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt AR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack proper validation of user-supplied data when parsing XE files. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Heap-based buffer overflow in Ashlar-Vellum Cobalt during parsing of VS drawing files allows an attacker to execute arbitrary code in the context of the victim's process. Exploitation requires the target to open a crafted VS file (user interaction), and no authentication or server-side access is needed because the flaw sits in the file parser. No public exploit code has been identified and the issue is not listed in CISA KEV; the vendor advisory is ZDI-26-587.
Arbitrary code execution and information disclosure in the Ashlar-Vellum CAD/3D-modeling suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.1204.216 and prior) can be triggered when the application parses a maliciously crafted VC6 file. The flaw is an out-of-bounds read (CWE-125) reached through the file-import path, giving an attacker who convinces a user to open a booby-trapped file the ability to leak memory or run code in the context of the victim. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), consistent with the local, user-interaction-dependent attack model reported by CISA ICS-CERT.
Arbitrary code execution and information disclosure in Ashlar-Vellum's CAD suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.1204.216 and prior) is possible when the application parses a specially crafted VC6 file, driven by an out-of-bounds read (CWE-125). An attacker who convinces a user to open a malicious VC6 file can read out-of-bounds memory to leak data or steer execution toward running arbitrary code in the context of the user. There is no public exploit identified at time of analysis, the EPSS score is negligible (0.01%), and CISA's SSVC framework rates exploitation as 'none' but technical impact as 'total'.
Arbitrary code execution in the Ashlar-Vellum CAD suite (Cobalt, Xenon, Argon, Lithium, and Cobalt Share, versions 12.6.1204.216 and prior) occurs when the application parses a maliciously crafted VC6 file, triggering an out-of-bounds write. An attacker must convince a user to open a booby-trapped drawing file, after which code runs in the context of the victim's user account. There is no public exploit identified at time of analysis, and the EPSS probability is negligible (0.01%), consistent with the CISA/ICS-CERT SSVC assessment of no known exploitation.
A Heap-based Buffer Overflow vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.207 and prior that could allow an attacker to disclose. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An Out-of-Bounds Write vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.207 and prior that could allow an attacker to disclose information. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Parsing a maliciously crafted CO design file in Ashlar-Vellum Cobalt 12.2.1204.97 (the version identified in the CPE data) can trigger a use-after-free that allows arbitrary code execution in the context of the user running the application. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) shows the flaw is reachable without authentication (PR:N) but is not remotely reachable as a service: it is a local-vector issue that requires mandatory user interaction, meaning the victim must open the file or visit a page that serves it, and any code runs at the privileges of the current, normally non-elevated user (no scope change). Reported through Trend Micro's Zero Day Initiative as ZDI-CAN-26631 / ZDI-25-956, the issue has no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is low at 0.21% (11th percentile), consistent with a targeted, file-delivery-dependent client-side bug rather than a mass-exploited one.
Heap-based buffer overflow in Ashlar-Vellum Cobalt 12.2.1204.97 allows attackers to execute arbitrary code when a user opens a malicious CO file. The vulnerability requires user interaction (UI:R) and executes code in the context of the current user process; despite the 'remote code execution' label, it is not network-reachable without a lure. No public exploit has been identified at time of analysis, and EPSS indicates a low likelihood of exploitation (0.21%).
Integer overflow in the XE file-parsing routine of Ashlar-Vellum Cobalt 12.2.1204.97 lets an attacker execute arbitrary code in the context of the running process when a user opens a maliciously crafted XE file or visits a page that delivers one. Because the flaw is reached through local file parsing (AV:L) and requires the victim to be socially engineered into opening attacker-supplied content (UI:R), it is a genuine but non-urgent risk: there is no network-reachable attack surface independent of user action, and code runs only with the privileges of the user running Cobalt, with no scope change. No public exploit code has been identified at time of analysis, the vulnerability is not confirmed actively exploited (no CISA KEV listing), and EPSS is low at 0.20% (9th percentile), reflecting limited observed exploitation activity.
Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt CO File Parsing Memory Corruption Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt LI File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt AR File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt LI File Parsing Use-After-Free Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt VC6 File Parsing Integer Overflow Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt AR File Parsing Uninitialized Variable Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt LI File Parsing Integer Overflow Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt LI File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing XE files. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing VC6 files. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing CO files. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supplied data when parsing AR files. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of user-supplied data when parsing CO files. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of user-supplied data when parsing XE files. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt AR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack proper validation of user-supplied data when parsing XE files. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.