ZDI-26-587: Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Ashlar-Vellum Cobalt contains a heap-based buffer overflow (CWE-122) in its parsing of VS files, allowing remote attackers to execute arbitrary code in the context of the current process. The flaw results from a lack of proper validation of the length of user-supplied data before copying it into a heap-based buffer. Exploitation requires user interaction: the target must open a malicious VS file or visit a malicious page, so victims are typically lured via social engineering rather than compromised remotely without interaction. A successful exploit gives the attacker code execution with the privileges of the user running Cobalt. The flaw was coordinated under ZDI-CAN-28173 and published as ZDI-26-587; no public PoC is known and there is no evidence of exploitation in the wild.

Do: Apply Ashlar-Vellum's patched Cobalt release as soon as one becomes available and track ZDI-26-587 for status updates, since the disclosure lists no fixed versions yet. Until then, treat unsolicited VS files as untrusted: do not open files received from unknown or unverified sources, and beware of links or attachments that prompt Cobalt to load a file. Run Cobalt under a standard (non-administrative) account to limit the impact of successful code execution.