A critical out-of-bounds read vulnerability in Ashlar-Vellum Cobalt allows for remote code execution when a user opens a specially crafted XE file.

The vulnerability exists within the XE file parsing logic, where insufficient validation of user-supplied data leads to an out-of-bounds read. This flaw can be triggered by an unauthenticated attacker if they successfully entice a user to open a malicious XE file.

The ability to achieve remote code execution poses a severe risk to organizational security, as it allows attackers to run arbitrary code with the privileges of the application user. Given the CVSS score of 7.8, this vulnerability represents a high risk that could lead to full system compromise, data theft, or the installation of persistent malicious software.

Immediate Action: Since no specific patch version is currently identified, users should refrain from opening untrusted XE files and monitor official Ashlar-Vellum security advisories for the release of a corrective update.

Proactive Monitoring: Security teams should monitor workstation endpoints for unusual process spawning behavior originating from the Cobalt application.

Compensating Controls: Deploy endpoint protection solutions capable of identifying and blocking malicious file execution or anomalous memory access patterns.

Public Exploit Available: Unknown.

Organizations utilizing Ashlar-Vellum Cobalt should prioritize awareness regarding the risks of opening external files. While a patch is not yet confirmed, maintaining strict file-handling policies and monitoring for vendor updates is essential to mitigating the potential for remote code execution.