CVE-2024-13046

Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution vulnerability affects Ashlar-Vellum Cobalt. The flaw arises in CO file parsing due to inadequate validation of input data, causing a write past the end of an allocated buffer and enabling code execution in the target p...

CVE-2025-2012

CVE-2025-2012 affects Ashlar-Vellum Cobalt, with the vulnerability residing in VS file parsing. The flaw is an out-of-bounds read caused by insufficient validation of user-supplied data, allowing an attacker to execute arbitrary code in the context of the current process. Exploitation requires us...

CVE-2024-13045

CVE-2024-13045 affects Ashlar-Vellum Cobalt. The vulnerability is a stack-based buffer overflow in the AR file parser caused by insufficient validation of the length of user-supplied data before copying to a stack buffer, leading to remote code execution. Exploitation requires user interaction (t...

CVE-2023-42102

Ashlar-Vellum Cobalt AR File Parsing Type Confusion Remote Code Execution (CVE-2023-42102) affects Ashlar-Vellum Cobalt and stems from improper validation during AR file parsing, causing a type confusion. The vulnerability enables code execution in the context of the current process and requires ...

CVE-2024-13044

CVE-2024-13044 affects Ashlar-Vellum Cobalt AR file parsing. The issue is an out-of-bounds write caused by insufficient validation of AR file data, allowing code execution in the context of the current process. Exploitation details in the provided documents are limited to the ZDI advisory and NVD...

CVE-2024-13049

Ashlar-Vellum Cobalt XE is affected by a type confusion in the XE file parser caused by insufficient validation of user-supplied data. This vulnerability can allow code execution in the context of the target process, requiring user interaction (e.g., viewing a malicious page or file). Multiple so...

CVE-2025-2013

Ashlar-Vellum Cobalt CO file parsing vulnerability (CVE-2025-2013) is a use-after-free flaw in CO file handling that can lead to remote code execution. The root cause is failure to validate the existence of an object before performing operations on it, enabling an attacker to run code in the targ...

CVE-2023-34289

Ashlar-Vellum Cobalt is affected by a heap-based buffer overflow in AR file parsing that can enable remote code execution. The vulnerability stems from improper validation of the length of user-supplied data before copying it to a heap buffer, allowing an attacker to run code in the current proce...

CVE-2025-2018

CVE-2025-2018 affects Ashlar-Vellum Cobalt with a VS file parsing type-confusion vulnerability. The flaw arises from inadequate validation of user-supplied data, causing a type confusion that can execute code in the current process. Exploitation requires user interaction (target must visit a mali...

CVE-2023-34286

Ashlar-Vellum Cobalt is affected by a CO file parsing out-of-bounds write vulnerability. The flaw stems from improper validation of CO file data, allowing a write past the end of an allocated buffer and enabling remote code execution in the context of the current process. Exploitation requires us...

CVE-2024-13047

Ashlar-Vellum Cobalt CO File Parsing Type Confusion (CVE-2024-13047) affects Ashlar-Vellum Cobalt. The flaw arises from improper validation in CO file parsing, causing a type confusion that can allow code execution in the current process. Exploitation requires user interaction (target visits a ma...

CVE-2025-2020

Ashlar-Vellum Cobalt VC6 file parsing vulnerability (CVE-2025-2020) stems from improper validation in VC6 file parsing, allowing a write past the end of an allocated buffer. This leads to remote code execution in the context of the affected process. Exploitation requires user interaction (target ...

CVE-2025-2022

CVE-2025-2022 affects Ashlar-Vellum Cobalt. The vulnerability is a type confusion in the parsing of VS files caused by inadequate validation of input data, enabling arbitrary code execution in the process context. Exploitation requires user interaction (target user must visit a malicious page or ...

CVE-2023-42103

Ashlar-Vellum Cobalt AR File Parsing Use-After-Free allows remote code execution via AR file parsing. The flaw stems from not validating the existence of an object before performing operations, enabling code execution in the current process. Exploitation requires user interaction (visiting a mali...

CVE-2023-44437

CVE-2023-44437 affects Ashlar-Vellum Cobalt. The flaw is in the parsing of file types where the process loads a library from an unsecured location, enabling a threat actor to execute code in the current process. Exploitation requires user interaction (the target must visit a malicious page or ope...

CVE-2023-35712

Ashlar-Vellum Cobalt XE is affected by a remote code execution vulnerability in the XE file parser caused by uninitialized memory access. The issue allows an attacker, with user interaction (visiting a malicious page or opening a malicious XE file), to execute code in the context of the victim pr...

CVE-2024-13048

CVE-2024-13048 affects Ashlar-Vellum Cobalt XE: the vulnerability resides in the XE file parser, caused by insufficient validation of user-provided data, which can trigger a write past the end of an allocated buffer. This out-of-bounds write can allow an attacker to execute code in the context of...

CVE-2025-2017

CVE-2025-2017 affects Ashlar-Vellum Cobalt. The vulnerability is a buffer overflow in the CO file parser caused by improper validation of the length of user-supplied data before copying to a buffer, enabling remote code execution in the context of the current process. Exploitation requires user i...

CVE-2025-2021

Ashlar-Vellum Cobalt XE contains an integer overflow in the XE file parser that can lead to remote code execution. The flaw arises from improper validation of user-supplied data while parsing XE files, allowing code execution in the context of the current process. Exploitation requires user inter...

CVE-2023-42104

The CVE-2023-42104 entry concerns Ashlar-Vellum Cobalt AR File Parsing Use-After-Free Remote Code Execution. Affected software: Ashlar-Vellum Cobalt. The vulnerability arises in the parsing of AR files where the code fails to validate the existence of an object before performing operations, enabl...

CVE-2023-35709

Ashlar-Vellum Cobalt is affected by a heap-based buffer overflow in the CO-file parser that can lead to remote code execution. The flaw stems from insufficient validation of user-supplied data length prior to heap copying, with exploitation requiring user interaction (visiting a malicious page or...

CVE-2023-35715

CVE-2023-35715 affects Ashlar-Vellum Cobalt. The vulnerability lies in the parsing of AR files where memory is not properly initialized, enabling a remote code execution when a user opens a malicious AR file or visits a malicious page. The issue requires user interaction and could allow code exec...

CVE-2023-34293

CVE-2023-34293 concerns Ashlar-Vellum Cobalt. The vulnerability is an out-of-bounds write in the parsing of X_B/X_T files, caused by insufficient validation of user-supplied data, enabling remote code execution in the context of the affected process. The exploit requires user interaction (visitin...

CVE-2023-34302

CVE-2023-34302 describes a stack-based buffer overflow in Ashlar-Vellum Cobalt’s CO file parsing. The flaw stems from insufficient validation of the length of user-supplied data before copying it to a stack-based buffer, enabling a remote attacker to execute arbitrary code in the current process ...

CVE-2023-34310

CVE-2023-34310 affects Ashlar-Vellum Cobalt. The issue is an uninitialized memory access in the CO-file parser that can allow remote code execution. Exploitation requires user interaction (target must visit a malicious page or open a malicious file). The root cause is lack of proper memory initia...

CVE-2023-34311

The CVE-2023-34311 entry documents a vulnerability in Ashlar-Vellum Cobalt, where the untrusted pointer dereference occurs during parsing of CO files. The root cause is improper validation of a user-supplied value before dereferencing it as a pointer, enabling arbitrary code execution in the proc...

CVE-2023-42105

The connected sources confirm CVE-2023-42105 affects Ashlar-Vellum Cobalt, with a vulnerability in the AR file parser that leads to a type confusion when parsing AR data. Root cause: insufficient validation of user-supplied data, allowing an attacker to trigger a type confusion and execute code i...

CVE-2025-2023

CVE-2025-2023 concerns Ashlar-Vellum Cobalt LI file parsing. The flaw is an integer overflow during LI file parsing caused by inadequate validation of user-supplied data, which can lead to buffer allocation issues and arbitrary code execution in the context of the affected process. Exploitation r...

CVE-2023-35710

Ashlar-Vellum Cobalt is affected. The vulnerability lies in parsing CO files, where insufficient validation of user-supplied data length enables a stack-based buffer overflow that can allow code execution in the current process. Exploitation requires user interaction (e.g., visiting a malicious p...

CVE-2023-34287

CVE-2023-34287 affects Ashlar-Vellum Cobalt CO file parsing. The vulnerability is a stack-based buffer overflow caused by insufficient validation of the length of user-supplied data before copying it to a stack buffer, enabling remote code execution in the context of the current process. Exploita...

CVE-2023-34292

Ashlar-Vellum Cobalt is affected by CVE-2023-34292, where an out-of-bounds write in parsing X_B/X_T files can allow remote code execution. The flaw arises from insufficient validation of user-supplied data, causing a write before the start of an allocated buffer. Exploitation requires user intera...

CVE-2025-2014

Ashlar-Vellum Cobalt is affected by CVE-2025-2014, a vulnerability in the parsing of VS files due to an uninitialized memory access. The flaw can enable arbitrary code execution in the context of the current process when a user visits a malicious page or opens a malicious file, requiring user int...

CVE-2025-2019

Ashlar-Vellum Cobalt VC6 is affected by a heap-based buffer overflow in the VC6 file parser. The flaw stems from insufficient validation of user-supplied data length before copying into a heap buffer, enabling remote code execution in the context of the current process. Exploitation requires user...

CVE-2023-34290

Ashlar-Vellum Cobalt contains an out-of-bounds write vulnerability in the 3DS file parsing path that can lead to remote code execution. The flaw arises from insufficient validation of user-supplied data, allowing a write past the end of an allocated buffer. Exploitation requires user interaction ...

CVE-2023-34301

Ashlar-Vellum Cobalt is affected by a CO file parsing vulnerability described as an untrusted pointer dereference that enables remote code execution. The flaw arises from insufficient validation of a user-supplied value before it is dereferenced as a pointer, allowing code execution in the attack...

CVE-2023-39943

Ashlar-Vellum Cobalt family (Cobalt, Xenon, Argon, Lithium, and related components) is affected by CVE-2023-39943 due to improper validation of user-supplied XE data, leading to an out-of-bounds write that could allow arbitrary code execution. Affected versions include Cobalt v12 SP0 Build (1204....

CVE-2023-34304

CVE-2023-34304 affects Ashlar-Vellum Cobalt. The applicable vulnerability lies in the parsing of IGS files, caused by insufficient validation of user-supplied data that can drive a memory access past the end of an allocated buffer. This out-of-bounds condition enables arbitrary code execution whe...

CVE-2023-40222

CVE-2023-40222 affects Ashlar-Vellum products (Cobalt, Graphite, Xenon, Argon, Lithium) with a heap-based overflow caused by improper validation of user-supplied data when parsing CO files. The root cause is lack of input validation in CO file parsing, leading to arbitrary code execution in the r...

CVE-2023-42101

CVE-2023-42101 concerns Ashlar-Vellum Cobalt. The flaw is in the AR file parser, where insufficient validation of user-supplied data can cause a read past the end of an allocated buffer, enabling arbitrary code execution. Exploitation requires user interaction (target must visit a malicious page ...

CVE-2025-2015

CVE-2025-2015 concerns Ashlar-Vellum Cobalt, where a flaw in the VS file parsing allows a type confusion and potential remote code execution. The root cause is insufficient validation of user-supplied data during VS file parsing, enabling code execution in the target process. Exploitation require...

CVE-2023-34291

Ashlar-Vellum Cobalt is affected by CVE-2023-34291 due to an out-of-bounds write in the parsing of X_B or X_T files caused by insufficient validation of user-supplied data. This can allow remote attackers to execute arbitrary code in the context of the current process when a target visits a malic...

CVE-2023-34288

CVE-2023-34288 affects Ashlar-Vellum Cobalt XE through a flaw in XE file parsing caused by an uninitialized pointer that is accessed during parsing. The vulnerability allows remote code execution with the attacker gaining code execution in the context of the current process. Exploitation requires...

CVE-2023-35716

Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution vulnerability. An attacker can exploit AR file parsing by triggering a read past the end of an allocated buffer, allowing arbitrary code execution in the process. Exploit requires user interaction (visiting a malicious ...

CVE-2023-39427

CVE-2023-39427 affects Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77). The root cause is insufficient validation of user-supplied XE file data, causing an out-of-bounds write that could enable arbitrary code execution in the current process. Related sources ...

CVE-2025-2016

CVE-2025-2016 concerns Ashlar-Vellum Cobalt VC6, where the vulnerability lies in VC6 file parsing. The issue is a type-confusion in parsing VC6 files caused by insufficient validation of user-supplied data, allowing an attacker to execute code in the context of the current process. Exploitation r...

CVE-2023-34299

CVE-2023-34299 affects Ashlar-Vellum Cobalt CO file parsing. The flaw is a heap-based buffer overflow caused by insufficient validation of the length of user-supplied data before copying to a heap buffer, enabling remote code execution. Exploitation requires user interaction (visiting a malicious...

CVE-2023-35711

CVE-2023-35711 concerns Ashlar-Vellum Cobalt XE. The vulnerability is in the XE file parser where an unvalidated user-supplied value can be dereferenced as a pointer, enabling arbitrary code execution. Multiple sources (NVD, CVE records, ZDI advisory) describe it as a remote code execution vulner...

CVE-2023-35714

Ashlar-Vellum Cobalt (IGS) is affected by CVE-2023-35714. The vulnerability arises in the parsing of IGS files, due to improper validation of user-supplied data, causing a read-before-start of an allocated buffer (out-of-bounds read). This can enable remote code execution with the attacker’s code...

CVE-2023-34303

Ashlar-Vellum Cobalt is affected by an out-of-bounds read vulnerability in VC6 file parsing that can lead to remote code execution. The issue arises from missing validation of user-supplied data, allowing a read past the end of an allocated buffer. Exploitation requires user interaction (visiting...

CVE-2023-34305

CVE-2023-34305 affects Ashlar-Vellum Cobalt. The vulnerability is an out-of-bounds write in the parsing of X_B/X_T files caused by insufficient validation of user-supplied data, allowing a remote attacker to execute code in the context of the current process. Exploitation requires user interactio...