Remote Code Execution in Ashlar-Vellum Cobalt due to Type Confusion in File Parsing

CVE-2025-2022

What is CVE-2025-2022?

A type confusion vulnerability has been identified in the file parsing mechanism of Ashlar-Vellum Cobalt, allowing remote attackers to execute arbitrary code on compromised installations. This flaw occurs due to inadequate validation of user-supplied data during the parsing of VS files. Exploitation necessitates user interaction, such as visiting a malicious website or opening a compromised file. Attackers can take advantage of this weakness to run malicious code within the context of the current process, posing a significant risk to affected users.

References