CVE-2025-11464: Ashlar Cobalt RCE Vulnerability

CVE-2025-11464 Overview

CVE-2025-11464 is a heap-based buffer overflow vulnerability in Ashlar-Vellum Cobalt, a computer-aided design (CAD) application. The flaw resides in the parser that processes CO files. Attackers can leverage the issue to execute arbitrary code in the context of the current user.

Exploitation requires user interaction. The target must open a malicious CO file or visit a page that delivers one. The vulnerability is tracked under Zero Day Initiative identifier ZDI-CAN-26628 and classified as CWE-122: Heap-based Buffer Overflow.

Critical Impact
Successful exploitation grants remote attackers arbitrary code execution within the user's security context, enabling malware installation, data theft, and lateral movement from engineering workstations.

Affected Products

Ashlar-Vellum Cobalt version 12.2.1204.97
Windows installations of Ashlar-Vellum Cobalt processing CO files
CAD workstations using vulnerable Cobalt builds

Discovery Timeline

2025-10-29 - CVE-2025-11464 published to NVD
2025-11-04 - Last updated in NVD database

Technical Details for CVE-2025-11464

Vulnerability Analysis

The vulnerability exists in the CO file parsing logic within Ashlar-Vellum Cobalt. The parser copies attacker-controlled data from the file into a heap-allocated buffer without verifying that the source length fits the destination. When the supplied length exceeds the buffer capacity, adjacent heap memory is overwritten.

Heap corruption of this nature allows an attacker to overwrite object metadata, function pointers, or virtual table references stored on the heap. By controlling the layout of allocations before triggering the overflow, an attacker can redirect execution to a chosen address. The result is arbitrary code execution under the privileges of the user running Cobalt.

This flaw is local in attack vector but is delivered through standard social engineering. Engineers and designers routinely open CAD files from email, supplier portals, and shared drives, which gives attackers reliable delivery paths.

Root Cause

The root cause is missing length validation prior to a buffer copy operation against a heap allocation, consistent with CWE-122. The parser trusts size or count fields embedded in the CO file format rather than bounding them to the destination buffer size.

Attack Vector

An attacker crafts a malicious CO file containing oversized or malformed structures. The attacker delivers the file by email attachment, malicious download, or a web page that prompts the user to open it. When the victim opens the file in Cobalt, the parser triggers the overflow and executes the embedded payload. See the Zero Day Initiative Advisory ZDI-25-955 for additional technical context.

Detection Methods for CVE-2025-11464

Indicators of Compromise

Unexpected CO files arriving via email, messaging platforms, or unfamiliar web downloads on engineering workstations
Cobalt processes spawning child processes such as cmd.exe, powershell.exe, or rundll32.exe
Crash events or Windows Error Reporting entries originating from the Cobalt process during file open
Outbound network connections initiated by the Cobalt process to unknown hosts

Detection Strategies

Monitor process creation events where the parent process is the Cobalt executable and the child is a script interpreter or shell
Apply YARA or content rules to flag CO files with malformed length fields or anomalous structural sizes at email and web gateways
Inspect endpoint telemetry for heap corruption indicators such as access violations and stack pivots inside the Cobalt process

Monitoring Recommendations

Enable command-line and process ancestry logging on workstations that run CAD software
Forward Cobalt application crash logs to the central SIEM for correlation with file-open events
Track inbound CO file deliveries from external senders and correlate with subsequent endpoint alerts

How to Mitigate CVE-2025-11464

Immediate Actions Required

Restrict opening of CO files received from untrusted or external sources until a patched build is deployed
Inventory all systems running Ashlar-Vellum Cobalt 12.2.1204.97 and prioritize them for remediation
Apply application allowlisting and exploit mitigations such as Data Execution Prevention and Control Flow Guard on engineering hosts

Patch Information

At the time of publication, no vendor patch reference is listed in the NVD entry. Refer to the Zero Day Initiative Advisory ZDI-25-955 and the Ashlar-Vellum support channel for the latest fixed version of Cobalt. Upgrade all affected installations once a fixed release is available.

Workarounds

Block CO file attachments at the email gateway and quarantine them for review
Train CAD users to validate the source of CO files before opening and to report unexpected files
Run Cobalt under a least-privilege user account to limit the impact of code execution within the user context

bash

# Example: block inbound CO attachments at a mail gateway
# (adapt to your specific MTA or secure email gateway syntax)
attachment_filter:
  - extension: ".co"
    action: quarantine
    notify: secops@example.com