Integer Overflow Vulnerability in Ashlar-Vellum Cobalt XE File Parsing
CVE-2025-2021

7.8HIGH

Key Information:

Vendor

Ashlar-vellum

Status
Cobalt
Vendor
CVE Published:
11 March 2025

What is CVE-2025-2021?

The Ashlar-Vellum Cobalt XE software is susceptible to an integer overflow vulnerability in its file parsing functionalities. This issue arises from the inadequate validation of user-supplied data when processing XE files. An attacker can exploit this vulnerability by enticing a user to visit a malicious webpage or open a crafted XE file, leading to arbitrary code execution within the affected process. Proper measures must be taken to mitigate risks associated with this vulnerability, ensuring user data and system integrity are preserved.

Affected Version(s)

Cobalt 1204.91

References

https://www.zerodayinitiative.com/advisories/ZDI-25-125/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.