Remote Code Execution Vulnerability in Ashlar-Vellum Cobalt File Parsing

CVE-2025-2012

What is CVE-2025-2012?

The vulnerability in Ashlar-Vellum Cobalt is rooted in the improper handling of user-supplied data during the parsing of VS files. This flaw can lead to a read past the end of an allocated buffer, enabling attackers to execute arbitrary code within the context of the current process. User interaction is required, as the target must either open a malicious file or visit an infected webpage to trigger the exploit, posing a significant risk to system integrity if left unpatched.

References