CVE-2025-2018: Ashlar Cobalt VS File Parsing RCE Vulnerability

CVE-2025-2018 Overview

CVE-2025-2018 is a type confusion vulnerability [CWE-843] in Ashlar-Vellum Cobalt, a 3D modeling and CAD application. The flaw exists in the parser that handles VS files and stems from missing validation of user-supplied data. Attackers can leverage the type confusion condition to execute arbitrary code in the context of the current process.

Exploitation requires user interaction. A target must open a malicious VS file or visit a page that delivers one. The issue was reported through the Zero Day Initiative as ZDI-CAN-25245 and tracked publicly as ZDI-25-118.

Critical Impact
Successful exploitation grants arbitrary code execution with the privileges of the user running Cobalt, enabling full compromise of the workstation.

Affected Products

Ashlar-Vellum Cobalt 12.0.1204.91
Cobalt installations parsing untrusted VS files
Workstations where users open CAD files from external sources

Discovery Timeline

2025-03-11 - CVE-2025-2018 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2018

Vulnerability Analysis

The vulnerability resides in the VS file parser inside Ashlar-Vellum Cobalt. When the application processes a crafted VS file, it interprets a data structure as an incorrect type. This type confusion causes the parser to operate on memory using assumptions that do not match the actual object layout.

Attackers control the contents of the misinterpreted structure. By shaping the VS file, an attacker influences pointers, function references, or virtual table lookups that the parser dereferences. The resulting memory access leads to arbitrary code execution in the Cobalt process.

Exploitation occurs locally and requires user interaction. The attack vector aligns with typical CAD-focused social engineering: a malicious VS file delivered through email, file sharing, or a project handoff. No authentication is required, and the process inherits the privileges of the interactive user.

Root Cause

The root cause is the absence of type validation on user-supplied data within the VS file format. The parser commits to a type before confirming the structure of the input, producing the type confusion condition tracked as [CWE-843].

Attack Vector

The attacker crafts a VS file that triggers the parser to misinterpret an embedded object. When a Cobalt user opens the file, the application dereferences attacker-controlled values. The vulnerability requires local file handling but does not require attacker code to already be running. See ZDI-25-118 for additional technical context.

No verified proof-of-concept code is publicly available.
Refer to the ZDI advisory for technical details.

Detection Methods for CVE-2025-2018

Indicators of Compromise

Unexpected child processes spawned by Cobalt.exe, particularly command interpreters or scripting hosts
VS files arriving from untrusted email senders, external file shares, or unverified project sources
Crash dumps or Windows Error Reporting events naming Cobalt with access violations in the VS parser
Outbound network connections initiated by Cobalt shortly after opening a CAD file

Detection Strategies

Monitor process creation events where the parent image is Cobalt and the child is cmd.exe, powershell.exe, rundll32.exe, or wscript.exe
Inspect file write activity by Cobalt to user-writable autostart paths such as Startup folders and Run registry keys
Correlate Cobalt crashes with recent opening of VS files received from external sources
Apply behavioral identification rules for code execution originating from CAD application memory regions

Monitoring Recommendations

Enable command-line and process lineage logging on engineering workstations running Cobalt
Forward Cobalt application crash telemetry to the SIEM for correlation with file-open events
Track VS file ingress through mail gateways and managed file transfer systems
Alert on Cobalt processes loading unsigned modules or making outbound connections

How to Mitigate CVE-2025-2018

Immediate Actions Required

Restrict opening of VS files to those originating from trusted internal sources only
Treat VS attachments from external email as untrusted and quarantine them at the mail gateway
Run Cobalt under standard user accounts and never under administrative privileges
Apply application allowlisting to limit child processes that Cobalt can spawn

Patch Information

No vendor patch has been linked in the available references. Review the Zero Day Initiative Advisory ZDI-25-118 and the Ashlar-Vellum vendor channels for updates. Apply any released Cobalt update that supersedes version 12.0.1204.91 once available.

Workarounds

Block inbound VS files at email and web proxy gateways until a fixed Cobalt build is deployed
Open untrusted CAD files only inside an isolated virtual machine without network access
Use file integrity and provenance checks to confirm VS files originate from known engineering partners
Disable file association handlers that auto-launch Cobalt for VS files received from browsers or messaging clients

bash

# Example: block VS file execution via Windows AppLocker file hash or path rule
# Replace with the actual policy management workflow in your environment
New-AppLockerPolicy -RuleType Path -User Everyone `
  -Path "%USERPROFILE%\Downloads\*.vs" -Action Deny