Ashlar-Vellum Cobalt CO File Parsing Heap Overflow RCE (CVE-2025-11464)

Critical Vulnerability Information Vulnerability Name: (0Day) Ashlar-Vellum Cobalt CO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability Vulnerability IDs: - ZDI-25-955 - ZDI-CAN-26628 CVE ID: CVE-2025-11464 CVSS Score: 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Affected Vendor: Ashlar-Vellum Affected Product: Cobalt Vulnerability Details Description: This vulnerability allows remote attackers to execute arbitrary code on affected Ashlar-Vellum Cobalt installations. Exploitation requires user interaction, where the target must access a malicious page or open a malicious file. Specific Issue: A specific flaw exists during the parsing of CO files. Due to insufficient length validation before copying user-supplied data into a heap-based buffer, a heap-based buffer overflow occurs. Additional Details Reporting Timeline: - 2025-04-14: ZDI reported the vulnerability to the vendor - 2025-04-23: Vendor confirmed receipt of the report - 2025-07-30: ZDI requested an update - 2025-08-06: ZDI requested an update again - 2025-09-24: ZDI notified the vendor that a 0-day advisory would be published Mitigation: Due to the nature of the vulnerability, the only effective mitigation is to restrict interaction with the product. Disclosure Timeline 2025-04-14: Vulnerability reported to vendor 2025-10-16: Coordinated public advisory release 2025-10-16: Advisory updated Acknowledgments Rocco Calvi (@TecROc) with TecSecurity

Goal Reached Thanks to every supporter — we hit 100%!

Ashlar-Vellum Cobalt CO File Parsing Heap Overflow RCE (CVE-2025-11464)