Remote Code Execution Vulnerability in Ashlar-Vellum Cobalt File Parsing
CVE-2025-2014

7.8HIGH

Key Information:

Vendor

Ashlar-vellum

Status
Cobalt
Vendor
CVE Published:
11 March 2025

What is CVE-2025-2014?

A vulnerability in Ashlar-Vellum Cobalt allows attackers to execute arbitrary code via VS file parsing. The flaw arises from the misuse of uninitialized memory, posing risks when users interact with malicious pages or files. This can give unauthorized access in the context of the current process, highlighting the need for immediate awareness and remediation.

Affected Version(s)

Cobalt 1204.91

References

https://www.zerodayinitiative.com/advisories/ZDI-25-115/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.