Remote Code Execution Vulnerability in Ashlar-Vellum Cobalt File Parsing

CVE-2025-8003

What is CVE-2025-8003?

A remote code execution vulnerability exists within the parsing of CO files in Ashlar-Vellum Cobalt. The flaw is due to insufficient validation of user-supplied data, allowing an attacker to read past the end of an allocated data structure. To exploit this vulnerability, an attacker must coerce a user into visiting a malicious webpage or opening a malicious CO file, leading to potential arbitrary code execution in the context of the affected application.

References