Remote Code Execution Vulnerability in Ashlar-Vellum Cobalt CO File Parsing
CVE-2025-8001

7.8HIGH

Key Information:

Vendor

Ashlar-vellum

Status
Cobalt
Vendor
CVE Published:
17 September 2025

What is CVE-2025-8001?

A remote code execution vulnerability exists in Ashlar-Vellum Cobalt due to improper validation in CO file parsing. Attackers can exploit this flaw by enticing users to visit a malicious page or open a compromised file, leading to potential execution of arbitrary code within the context of the current process. This risk highlights the importance of stringent user data validation measures.

Affected Version(s)

Cobalt 12 SP1

References

https://www.zerodayinitiative.com/advisories/ZDI-25-721/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-8001 : Remote Code Execution Vulnerability in Ashlar-Vellum Cobalt CO File Parsing