Remote Code Execution Vulnerability in Ashlar-Vellum Cobalt File Parsing

CVE-2025-7995

What is CVE-2025-7995?

A vulnerability exists in the Ashlar-Vellum Cobalt product due to improper validation of user-supplied CO file data. This flaw leads to a type confusion condition that can be exploited by remote attackers. Successful exploitation requires user interaction, as the victim must open a malicious CO file or visit a compromised web page. If executed, this flaw can allow attackers to run arbitrary code in the context of the application, posing significant risks to affected installations.

References