CVE-2025-11463: Ashlar Cobalt XE File Parsing RCE Flaw

CVE-2025-11463 Overview

CVE-2025-11463 is an integer overflow vulnerability in Ashlar-Vellum Cobalt that allows remote attackers to execute arbitrary code on affected installations. The flaw resides in the parsing logic for XE files and stems from insufficient validation of user-supplied data prior to buffer allocation [CWE-190]. Exploitation requires user interaction: the target must open a crafted XE file or visit a malicious page hosting one. Successful exploitation yields code execution in the context of the current process. The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-26626 and published as ZDI-25-954.

Critical Impact
Attackers who convince a user to open a malicious XE file can execute arbitrary code on the host with the privileges of the Cobalt process, leading to full compromise of the user session.

Affected Products

Ashlar-Vellum Cobalt 12.2.1204.97
Ashlar-Vellum Cobalt XE file parser component
CAD workstations running vulnerable Cobalt installations

Discovery Timeline

2025-10-29 - CVE-2025-11463 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11463

Vulnerability Analysis

The vulnerability exists in the routine responsible for parsing Ashlar-Vellum XE files. During file ingestion, the parser reads a length or count field from the untrusted file and uses it in an arithmetic expression that calculates the size of a buffer to allocate. Because the value is not properly bounds-checked, a crafted input can cause the multiplication or addition to wrap around the integer width, yielding a small allocation. Subsequent write operations then copy attacker-controlled data based on the original (unwrapped) size, producing a heap-based buffer overflow.

An attacker who controls the overflowed memory can corrupt adjacent heap structures and pivot to arbitrary code execution within the Cobalt process. Because the application typically runs interactively under the logged-in user, code execution inherits that user's privileges and access to local files, network shares, and credentials cached by the session.

Root Cause

The root cause is missing validation of size-related fields parsed from XE files prior to use in buffer allocation arithmetic. The classification under CWE-190 (Integer Overflow or Wraparound) reflects the fact that the allocation size is computed from untrusted input without saturation checks, range checks, or use of checked arithmetic primitives.

Attack Vector

The attack vector is local file processing with required user interaction. An attacker delivers a malicious .xe file via email attachment, instant messaging, a drive-by download, or a shared project repository. When the victim opens the file in Ashlar-Vellum Cobalt, the integer overflow triggers during parsing and leads to memory corruption. No network exposure of the application is required, and no authentication to Cobalt is needed beyond the user's normal session.

No proof-of-concept exploit, vendor advisory, or public exploitation has been disclosed at the time of writing. Technical details are referenced in the Zero Day Initiative Advisory ZDI-25-954.

Detection Methods for CVE-2025-11463

Indicators of Compromise

Unexpected crashes or abnormal termination of Cobalt.exe shortly after opening an XE file.
Creation of child processes such as cmd.exe, powershell.exe, or scripting hosts spawned from the Cobalt process.
Inbound .xe files arriving from untrusted senders or external file-sharing links.
New persistence entries (Run keys, scheduled tasks, services) created in the same session a Cobalt crash occurred.

Detection Strategies

Monitor process lineage for Cobalt spawning shell, scripting, or LOLBin processes, which is anomalous for a CAD application.
Apply YARA or content inspection at the mail and web gateway for XE files with malformed or oversized length fields.
Correlate application crash telemetry (Windows Error Reporting, WER) for Cobalt with subsequent suspicious process or network activity.

Monitoring Recommendations

Enable command-line and module-load auditing on hosts running Cobalt to capture post-exploitation behavior.
Track file write events that place .xe files in user-writable directories from browser or mail client processes.
Alert on outbound network connections originating from Cobalt.exe, which would not be expected during normal CAD work.

How to Mitigate CVE-2025-11463

Immediate Actions Required

Restrict opening of XE files received from external or untrusted sources until a vendor patch is applied.
Inventory endpoints running Cobalt 12.2.1204.97 and prioritize them for monitoring and update once a fix is released.
Educate users that opening untrusted Ashlar-Vellum files can lead to code execution and should be treated like opening unknown executables.

Patch Information

No vendor advisory or patched version was referenced in the NVD entry at publication. Administrators should monitor Ashlar-Vellum's support channels and the Zero Day Initiative Advisory ZDI-25-954 for updated fix information and apply the vendor's recommended build as soon as it is available.

Workarounds

Block .xe file attachments at email gateways and inspect file-sharing platforms for the same extension from external sources.
Run Cobalt under a standard (non-administrator) user account to limit the impact of code execution within the process.
Use application allowlisting to prevent Cobalt from launching child processes such as shells and scripting interpreters.
Maintain endpoint protection with behavioral analytics capable of detecting heap corruption exploitation patterns and anomalous process activity.

bash

# Example: block .xe attachments at a Postfix gateway via header_checks
# /etc/postfix/header_checks
/^Content-(Disposition|Type).*name\s*=\s*"?[^"]+\.xe"?/ REJECT .xe files are blocked by policy