Ashlar-Vellum Cobalt Out-of-Bounds Write Vulnerability Allowing Arbitrary Code Execution

A vulnerability exists in Ashlar-Vellum Cobalt versions prior to v12 SP2 Build 1204.200, as well as in Cobalt Share, Xenon, Argon, and Lithium, all of which are also prior to v12 SP2 Build 1204.200. The issue arises from the application's improper validation of user-supplied data when parsing XE files, leading to an out-of-bounds write. This vulnerability could be exploited by an attacker to execute arbitrary code within the context of the current process.

Impact

Exploitation of this vulnerability could allow an attacker to execute arbitrary code in the context of the current process.

Remediation

Users are advised to update to the latest version of Ashlar-Vellum Cobalt by installing v12 SP12 Alpha Build 1204.200, released on January 22, 2025. For Graphite, the latest version is v13.0.48. Additionally, only open files from trusted sources.