CVE-2025-11465: Ashlar Cobalt RCE Vulnerability

CVE-2025-11465 Overview

CVE-2025-11465 is a use-after-free vulnerability [CWE-416] in Ashlar-Vellum Cobalt that allows attackers to execute arbitrary code on affected installations. The flaw resides in the parsing logic for CO files and stems from the application performing operations on an object without validating that the object still exists. Exploitation requires user interaction. A target must open a crafted CO file or visit a malicious page that delivers one. Successful exploitation grants code execution in the context of the current process. The issue was reported through the Zero Day Initiative as ZDI-CAN-26631.

Critical Impact
Attackers who deliver a malicious CO file to a user can execute arbitrary code in the context of the Cobalt process, leading to full compromise of the user's session.

Affected Products

Ashlar-Vellum Cobalt 12.2.1204.97
Ashlar-Vellum Cobalt CO file parser component
Workstations running vulnerable Cobalt CAD/3D modeling software

Discovery Timeline

2025-10-29 - CVE-2025-11465 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11465

Vulnerability Analysis

The vulnerability is a use-after-free condition triggered during the parsing of Ashlar-Vellum CO files. Cobalt processes a CO file and performs operations on an object that has already been freed or was never properly instantiated. The parser does not validate the existence of the target object before dereferencing it. An attacker who controls the layout of the CO file can influence the freed memory region and place a controlled object or pointer at that location.

When the parser later uses the dangling reference, the attacker-controlled data is treated as a valid object. This leads to arbitrary code execution in the security context of the user running Cobalt. The Common Weakness Enumeration entry for this class of bug is [CWE-416]. Exploitation is local and requires the victim to open a malicious file, which is consistent with typical client-side CAD application attack patterns.

Root Cause

The root cause is missing object lifetime validation in the CO file parser. Cobalt frees or fails to initialize an internal object during file processing and subsequently performs read or write operations against that stale reference. Without a check confirming object validity prior to use, the parser dereferences attacker-influenced memory.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious CO file and delivers it through email, file-sharing services, a compromised website, or a drive-by download. When the victim opens the file in Ashlar-Vellum Cobalt, the use-after-free is triggered and code executes in the context of the Cobalt process.

No verified public exploit code is available for CVE-2025-11465. The vulnerability mechanism is described in the Zero Day Initiative Advisory ZDI-25-956.

Detection Methods for CVE-2025-11465

Indicators of Compromise

Unexpected child processes spawned by Cobalt.exe such as command interpreters, scripting engines, or rundll32.exe.
Inbound CO files arriving via email, browser downloads, or removable media from untrusted senders.
Crashes or abnormal termination of Cobalt immediately after opening a CO file, recorded in Windows Event Log.
Outbound network connections initiated by Cobalt.exe to previously unseen external hosts.

Detection Strategies

Monitor process creation events where the parent process is Cobalt.exe and the child is a shell, scripting host, or LOLBin.
Inspect CO file attachments and downloads with file-type-aware sandboxing to observe parsing behavior before user delivery.
Apply EDR behavioral rules that flag memory corruption indicators such as anomalous heap allocations followed by control-flow deviation in Cobalt.exe.

Monitoring Recommendations

Centralize endpoint telemetry covering process trees, image loads, and file writes performed by Cobalt.exe.
Alert on Cobalt application crashes correlated with recently opened CO files for forensic triage.
Track network egress from CAD workstations, which typically have a narrow and predictable outbound traffic profile.

How to Mitigate CVE-2025-11465

Immediate Actions Required

Restrict opening of CO files to those received from trusted, verified sources until a patched build is deployed.
Inventory all workstations running Ashlar-Vellum Cobalt and identify hosts on version 12.2.1204.97.
Apply least-privilege controls so Cobalt does not run with administrative rights, limiting the blast radius of code execution.

Patch Information

Refer to the vendor and the Zero Day Initiative Advisory ZDI-25-956 for patch availability and version guidance. Upgrade to the latest Cobalt release provided by Ashlar-Vellum once available, and validate the deployed build version on all affected endpoints.

Workarounds

Block delivery of CO files at email and web gateways for users who do not require them.
Open untrusted CO files only inside an isolated virtual machine or sandbox segregated from production data.
Use application allowlisting to prevent Cobalt.exe from spawning shells, scripting engines, or other unrelated executables.

bash

# Example: block CO file attachments at an email gateway (illustrative)
add content-filter rule name="Block-Cobalt-CO" \
    match-attachment-extension="co" \
    action=quarantine \
    notify-admin=true