CVE-2025-2012: Ashlar Cobalt RCE Vulnerability

CVE-2025-2012 Overview

CVE-2025-2012 is an out-of-bounds read vulnerability in Ashlar-Vellum Cobalt, a computer-aided design (CAD) application used for 2D drafting and 3D modeling. The flaw resides in the parser responsible for handling VS files. Attackers can exploit this vulnerability to execute arbitrary code in the context of the current process. Exploitation requires user interaction, meaning the target must open a crafted VS file or visit a malicious page that delivers one. The issue was originally reported through the Zero Day Initiative as ZDI-CAN-25185 and tracks to weakness class [CWE-125].

Critical Impact
Successful exploitation grants arbitrary code execution under the privileges of the user running Ashlar-Vellum Cobalt, enabling full compromise of the local user context.

Affected Products

Ashlar-Vellum Cobalt 12.0.1204.91
Ashlar-Vellum Cobalt VS file parser component
Workstations running vulnerable Cobalt installations on supported operating systems

Discovery Timeline

2025-03-11 - CVE-2025-2012 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2012

Vulnerability Analysis

The vulnerability stems from improper validation of user-supplied data inside the VS file parsing logic of Ashlar-Vellum Cobalt. When the application processes a malformed VS file, the parser reads past the end of an allocated buffer. This out-of-bounds read exposes adjacent memory contents that the parser then treats as legitimate structured data.

Because the parsed values influence subsequent control flow and object construction inside Cobalt, an attacker can manipulate them to redirect execution. The result is arbitrary code execution in the context of the user process. The local attack vector and user interaction requirement mean that exploitation typically begins with social engineering, such as a phishing email carrying a crafted CAD design file.

Root Cause

The root cause is missing bounds checking on attacker-controlled length or index fields inside VS files. The parser trusts size metadata embedded in the file and reads buffer contents without validating that the read stays within the allocated region. This pattern matches [CWE-125]: Out-of-bounds Read.

Attack Vector

An attacker crafts a malicious VS file and delivers it through email, a shared file repository, or a web download. When a user opens the file in Ashlar-Vellum Cobalt, the parser triggers the out-of-bounds read. The attacker leverages the disclosed memory and corrupted parser state to achieve code execution within the Cobalt process. Refer to the Zero Day Initiative Advisory ZDI-25-119 for additional technical detail.

// No verified public exploit code is available for CVE-2025-2012.
// Technical specifics of the parsing flaw are described in ZDI-25-119.

Detection Methods for CVE-2025-2012

Indicators of Compromise

Unexpected Cobalt.exe child processes such as command shells, scripting hosts, or rundll32.exe
VS files arriving from untrusted email senders, external file-sharing services, or unusual network shares
Cobalt process crashes or access violation events generated while opening third-party CAD files

Detection Strategies

Monitor process creation events where Ashlar-Vellum Cobalt spawns interpreters, shells, or living-off-the-land binaries
Hunt for VS file extensions originating from web downloads or email attachments that are then opened by Cobalt
Correlate Windows Error Reporting and application crash telemetry against Cobalt to surface failed exploitation attempts

Monitoring Recommendations

Forward endpoint process, file, and image-load telemetry to a central analytics platform for retrospective hunting
Alert on Cobalt loading unexpected modules or making outbound network connections shortly after opening a document
Track user-opened CAD files against known-good hashes to flag suspicious or newly introduced VS files

How to Mitigate CVE-2025-2012

Immediate Actions Required

Inventory all systems running Ashlar-Vellum Cobalt and identify hosts at version 12.0.1204.91 or earlier
Restrict opening of VS files to those originating from trusted, verified sources
Brief users on the risk of opening unsolicited CAD files received via email, chat, or web download

Patch Information

No fixed version is referenced in the current advisory data. Organizations should monitor Ashlar-Vellum communications and the Zero Day Initiative Advisory ZDI-25-119 for updates regarding a vendor patch and apply it once released.

Workarounds

Block inbound VS file attachments at the email gateway until a vendor patch is available
Run Ashlar-Vellum Cobalt under standard user accounts without local administrator rights to limit post-exploitation impact
Use application allowlisting to prevent Cobalt from launching scripting engines or command interpreters
Isolate workstations that handle untrusted CAD files in a segmented network zone

bash

# Example: block VS file attachments at an email gateway (illustrative)
# Adjust to your mail security product's policy syntax
add-attachment-rule \
  --name "Block-Ashlar-VS-Files" \
  --match-extension "vs" \
  --action quarantine \
  --notify security-ops@example.com