Ashlar-Vellum Cobalt Type Confusion Remote Code Execution Vulnerability

A type confusion vulnerability allowing remote code execution has been identified in Ashlar-Vellum Cobalt XE. The issue arises from improper validation of user-supplied data in the parsing of XE files, leading to a type confusion condition. Exploitation of this vulnerability requires user interaction, as the target must open a malicious file or visit a harmful webpage.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, executed in the context of the current process.

Remediation

Due to the nature of this vulnerability, the primary recommendation is to limit interactions with the product.