Ashlar-Vellum Cobalt VC6 File Parsing OOB Read RCE (CVE-2025-7991)

Critical Vulnerability Information Vulnerability Name: (0Day) Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability ZDI ID: ZDI-25-643, ZDI-CAN-25945 CVE ID: CVE-2025-7991 CVSS Score: 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Affected Vendor: Ashlar-Vellum Affected Product: Cobalt Vulnerability Details Description: This vulnerability allows remote attackers to execute arbitrary code on affected Ashlar-Vellum Cobalt installations. Exploitation requires user interaction, where the target must access a malicious page or open a malicious file. Specific Issue: A specific flaw exists during the parsing of VC6 files. Due to insufficient validation of user-supplied data, the application reads beyond the end of an allocated data structure. Attackers can exploit this to execute code within the context of the current process. Additional Details Report Date: December 19, 2024 – ZDI reported the vulnerability to the vendor Update Request: February 5, 2025 – ZDI requested an update Disclosure Notification: July 15, 2025 – ZDI notified the vendor that the case would be published as a 0-day disclosure Mitigation: Given the nature of the vulnerability, the only effective mitigation is to restrict interaction with the product Disclosure Timeline Reported to Vendor: December 19, 2024 Coordinated Public Release: July 22, 2025 Announcement Update: July 22, 2025 Acknowledgments Discoverer: Rocco Calvi (@TecR0c) with TecSecurity

Goal Reached Thanks to every supporter — we hit 100%!

Ashlar-Vellum Cobalt VC6 File Parsing OOB Read RCE (CVE-2025-7991)