Integer Overflow Vulnerability in Ashlar-Vellum Cobalt

CVE-2025-2023

What is CVE-2025-2023?

A critical integer overflow vulnerability exists in the parsing of LI files within Ashlar-Vellum Cobalt, enabling remote attackers to execute arbitrary code. This flaw arises from insufficient validation of user-supplied data, allowing an integer overflow before buffer allocation. Exploitation requires user interaction, as targets must open a malicious file or visit a compromised web page. Addressing this vulnerability is essential for maintaining the integrity and security of affected installations.

References