Ashlar-Vellum Cobalt CO File Parsing Use-After-Free Remote Code Execution Vulnerability

A use-after-free vulnerability has been identified in Ashlar-Vellum Cobalt, specifically within the CO file parsing process. This flaw allows remote attackers to execute arbitrary code on affected systems. The vulnerability arises from improper validation of object existence before performing operations, creating an opportunity for exploitation. Notably, user interaction is required, as the target must open a malicious CO file or visit a harmful webpage.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the current process.

Remediation

Due to the nature of this vulnerability, the primary recommendation is to limit interactions with the product, especially regarding CO files or potentially malicious webpages.