A use-after-free vulnerability in Ashlar-Vellum Cobalt allows remote code execution when a user opens a specially crafted LI file, posing a critical security risk.

This use-after-free vulnerability (CWE-416) exists within the LI file parsing component, where the application fails to validate object existence before performing operations. The attack requires user interaction, specifically opening a malicious file, and can be triggered by an unauthenticated attacker.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code within the context of the current user process. This could lead to a full system compromise, unauthorized data access, or the deployment of persistent malware. With a CVSS score of 7.8, this high-severity flaw represents a significant threat to organizational data integrity and system availability.

Immediate Action: Since a specific patch is not currently identified, users should exercise extreme caution when opening files from untrusted sources and monitor vendor communications for an upcoming security update.

Proactive Monitoring: Security teams should monitor endpoint logs for abnormal application behavior or unexpected process execution following the opening of LI files.

Compensating Controls: Organizations should employ endpoint protection software capable of detecting malicious file structures and implement strict file-handling policies for users.

Public Exploit Available: Unknown

Given the potential for remote code execution, users of Ashlar-Vellum Cobalt should restrict their exposure by only processing LI files from trusted and verified sources. Administrators must prioritize applying the official vendor patch as soon as it is released to eliminate the underlying memory management flaw.