CVE-2024-13046: Ashlar Cobalt RCE Vulnerability

CVE-2024-13046 Overview

CVE-2024-13046 is an out-of-bounds write vulnerability [CWE-787] in Ashlar-Vellum Cobalt, a 3D CAD modeling application. The flaw resides in the parser for .CO files and stems from insufficient validation of user-supplied data. An attacker who convinces a user to open a malicious .CO file can write past the end of an allocated buffer and execute arbitrary code in the context of the current process. The issue was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-24867 and disclosed in advisory ZDI-24-1730.

Critical Impact
Successful exploitation yields arbitrary code execution with the privileges of the user running Ashlar-Vellum Cobalt, enabling full compromise of the workstation.

Affected Products

Ashlar-Vellum Cobalt 12.0.1204.90
Ashlar-Vellum Cobalt (earlier versions using the same .CO parser)
Windows workstations with Cobalt installed and associated with .CO file handlers

Discovery Timeline

2024-12-30 - CVE-2024-13046 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13046

Vulnerability Analysis

The vulnerability exists in the routine that parses Ashlar-Vellum Cobalt .CO project files. Cobalt reads structured records from the file and copies data into fixed-size buffers without confirming that the source length fits the destination. A crafted .CO file with oversized or malformed length fields drives the parser to write beyond the allocated buffer boundary. Attackers can shape the overflow to corrupt adjacent objects, function pointers, or virtual table references and redirect execution. Because Cobalt runs as an interactive desktop application, the attacker inherits the logged-in user's privileges, including access to design files, network shares, and cached credentials.

Root Cause

The root cause is missing input validation on length or index fields inside .CO file records, resulting in an out-of-bounds write [CWE-787]. The parser trusts attacker-controlled sizes and performs the copy operation without a bounds check against the destination buffer.

Attack Vector

Exploitation requires user interaction. The victim must open a malicious .CO file delivered by email, download, shared design repository, or a crafted web page that invokes the Cobalt file handler. The attack vector is local per the CVSS metrics, but the delivery mechanism can be remote through standard file-sharing channels.

No public proof-of-concept code has been published. Refer to the Zero Day Initiative Advisory ZDI-24-1730 for the vendor-coordinated technical summary.

Detection Methods for CVE-2024-13046

Indicators of Compromise

Unexpected child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned by the Cobalt executable
.CO files arriving from untrusted email attachments, external drives, or web downloads before an application crash
Windows Error Reporting events referencing the Cobalt process with access-violation exceptions during file open
Outbound network connections initiated by the Cobalt process to previously unseen hosts

Detection Strategies

Monitor process-lineage telemetry for the Cobalt binary spawning shells, script interpreters, or LOLBins
Alert on write access-violation crashes in the Cobalt process, which often precede successful exploitation attempts
Inspect email and web gateways for .CO attachments originating outside the engineering supply chain

Monitoring Recommendations

Centralize endpoint process, file, and crash telemetry from workstations running CAD software for correlation
Track file-open events for .CO extensions and correlate with the source path and delivery mechanism
Baseline normal Cobalt network behavior and alert on deviations such as HTTP or DNS activity from the process

How to Mitigate CVE-2024-13046

Immediate Actions Required

Restrict opening of .CO files to those originating from trusted internal repositories and known collaborators
Instruct CAD users to validate the sender and origin of any .CO file received through email or messaging
Run Ashlar-Vellum Cobalt under a standard user account, never with administrative privileges
Isolate CAD workstations from sensitive network segments until a vendor patch is applied

Patch Information

At the time of publication, no vendor advisory or fixed version is referenced in the NVD entry. Consult the Zero Day Initiative Advisory ZDI-24-1730 and the Ashlar-Vellum support channels for updated builds addressing the .CO parser flaw.

Workarounds

Block .CO file attachments at the email gateway when they are not required for business workflows
Enable Windows Attack Surface Reduction rules that limit child-process creation from Office and desktop applications
Apply application allowlisting to prevent unauthorized executables launched by Cobalt from running
Store shared CAD assets in access-controlled repositories with integrity checks to reject tampered files

bash

# Example: block .CO attachments at an Exchange transport rule (PowerShell)
New-TransportRule -Name "Block Ashlar CO attachments" \
  -AttachmentExtensionMatchesWords "co" \
  -RejectMessageReasonText "CO files blocked pending CVE-2024-13046 remediation"