Out-Of-Bounds Read Vulnerability in Ashlar-Vellum Cobalt Product

CVE-2025-7989

What is CVE-2025-7989?

A security vulnerability in Ashlar-Vellum's Cobalt product allows remote attackers to execute arbitrary code through a flaw in AR file parsing. The vulnerability arises from inadequate validation of user-supplied data, which can lead to unintended read operations beyond allocated data structures. An exploit requires user interaction, as the target must access a malicious webpage or open a compromised file. This flaw poses significant risks, enabling attackers to gain control within the context of the current process.

References