A critical out-of-bounds write vulnerability in Ashlar-Vellum Cobalt allows remote attackers to execute arbitrary code when a user opens a malicious CO file.

This vulnerability is an out-of-bounds write (CWE-787) occurring during the parsing of CO files. Successful exploitation requires user interaction, specifically convincing a target to open a malicious file, and allows the attacker to execute code in the context of the current process.

The ability for an attacker to execute arbitrary code on a user workstation presents a severe security risk, including potential data theft, malware installation, and lateral movement within the corporate network. With a CVSS score of 7.8, this vulnerability is classified as High severity, reflecting the significant impact on system integrity and confidentiality.

Immediate Action: Users should apply the latest security patches provided by Ashlar-Vellum for Cobalt immediately to address the file parsing defect.

Proactive Monitoring: Security teams should monitor endpoint logs for suspicious file-handling activities or unexpected child processes spawned by the Cobalt application.

Compensating Controls: Implement strict email filtering and endpoint protection policies to prevent users from opening untrusted or suspicious CO files.

Public Exploit Available: Unknown.

Given the potential for remote code execution, this vulnerability poses a significant risk to organizational endpoints. Administrators must prioritize the deployment of the vendor-supplied patch to ensure the CO file parser is properly secured against malformed inputs. Until patching is complete, users should be advised to exercise caution when handling CO files from untrusted or unknown sources.