AI analysis
Ashlar-Vellum Cobalt contains a heap-based buffer overflow (CWE-122) in its parsing of VS files, allowing remote attackers to execute arbitrary code in the context of the current process. The flaw results from a lack of proper validation of the length of user-supplied data before copying it into a heap-based buffer. Exploitation requires user interaction: the target must open a malicious VS file or visit a malicious page, so victims are typically lured via social engineering rather than compromised remotely without interaction. A successful exploit gives the attacker code execution with the privileges of the user running Cobalt. The flaw was coordinated under ZDI-CAN-28173 and published as ZDI-26-587; no public PoC is known and there is no evidence of exploitation in the wild.
What to do: Apply Ashlar-Vellum's patched Cobalt release as soon as one becomes available and track ZDI-26-587 for status updates, since the disclosure lists no fixed versions yet. Until then, treat unsolicited VS files as untrusted: do not open files received from unknown or unverified sources, and beware of links or attachments that prompt Cobalt to load a file. Run Cobalt under a standard (non-administrative) account to limit the impact of successful code execution.
Estimated exposure
nicheunknown; plausibly on the order of thousands to tens of thousands of installed Cobalt seats — Cobalt is a niche commercial desktop CAD package with no public install counts and no internet-exposed attack surface, since exploitation requires a user on the workstation to open a malicious file or page.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of VS files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28173.