Ashlar-Vellum Cobalt LI File Parsing Use-After-Free Remote Code Execution Vulnerability

A use-after-free vulnerability has been identified in Ashlar-Vellum Cobalt, specifically within the parsing of LI files. This flaw allows remote attackers to execute arbitrary code on affected installations. The vulnerability arises from the improper validation of an object's existence before performing operations on it, creating an opportunity for exploitation. Notably, user interaction is required, as the target must either visit a malicious page or open a harmful file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the current process.

Remediation

Due to the nature of this vulnerability, the primary recommended mitigation is to limit interaction with the Ashlar-Vellum Cobalt product.