CVE-2025-8006: Ashlar Cobalt XE File Parsing RCE Flaw

CVE-2025-8006 Overview

CVE-2025-8006 is an out-of-bounds read vulnerability [CWE-125] in Ashlar-Vellum Cobalt, a 3D modeling and CAD application. The flaw resides in the parser that handles XE files. Insufficient validation of user-supplied data allows a read past the end of an allocated buffer. An attacker who convinces a user to open a crafted XE file or visit a malicious page can execute arbitrary code in the context of the current process. The issue was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-26238 and assigned advisory ZDI-25-725.

Critical Impact
Successful exploitation grants arbitrary code execution with the privileges of the user running Ashlar-Vellum Cobalt, leading to full confidentiality, integrity, and availability compromise of the host.

Affected Products

Ashlar-Vellum Cobalt (CPE: cpe:2.3:a:ashlar:cobalt:-:*:*:*:*:*:*:*)
Ashlar-Vellum Cobalt XE file parser component
Workstations used for CAD/3D modeling running vulnerable Cobalt builds

Discovery Timeline

2025-09-17 - CVE-2025-8006 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8006

Vulnerability Analysis

The vulnerability lives in the routine that parses Ashlar-Vellum Cobalt XE files. The parser trusts size or offset fields embedded in the file without verifying them against the bounds of the allocated structure. When the parser dereferences memory using these unvalidated values, it reads beyond the end of the buffer.

The out-of-bounds read [CWE-125] exposes adjacent process memory, which an attacker can leverage to disclose pointers, defeat ASLR, or steer subsequent control-flow operations. Combined with predictable heap state in the Cobalt process, the primitive can be escalated to arbitrary code execution within the user's session.

Exploitation requires user interaction. The victim must open a malicious XE file or visit a page that delivers one. Code runs at the privilege level of the Cobalt user, which on engineering workstations frequently includes access to sensitive design data.

Root Cause

The root cause is missing validation of length and offset fields in the XE file format. The parser uses attacker-controlled values to compute a memory access without checking that the resulting address falls within the bounds of the allocated structure.

Attack Vector

The attack vector is local file handling. An attacker delivers a crafted XE file through email attachment, file share, web download, or supply chain channels such as CAD asset libraries. The vulnerability triggers when Cobalt opens the file. No network position or authentication is required, but user interaction is mandatory.

No verified public proof-of-concept code is available. The Zero Day Initiative advisory ZDI-25-725 provides the authoritative technical reference. See the Zero Day Initiative Advisory ZDI-25-725 for details.

Detection Methods for CVE-2025-8006

Indicators of Compromise

Unexpected XE files arriving from external sources, email attachments, or untrusted file shares prior to a Cobalt crash or unusual child process spawn.
Crashes, exception logs, or Windows Error Reporting entries originating from the Cobalt process while parsing XE files.
Cobalt spawning unexpected child processes such as cmd.exe, powershell.exe, or scripting hosts shortly after a file open event.

Detection Strategies

Monitor process telemetry for Cobalt creating child processes, writing executables, or establishing outbound network connections after opening a document.
Inspect file-write events for XE files dropped into user profile or shared engineering directories from browser, mail, or messaging clients.
Apply YARA or content inspection on email and file gateways to flag XE files with malformed structural headers.

Monitoring Recommendations

Enable EDR rules that alert on memory access violations and crashes within cobalt.exe.
Forward Windows application and security event logs to a central SIEM and alert on repeated Cobalt faults across hosts.
Track CAD workstations as a distinct asset group with heightened logging for document open and child process events.

How to Mitigate CVE-2025-8006

Immediate Actions Required

Restrict opening of XE files to those originating from trusted, internal sources only.
Apply application allowlisting to prevent Cobalt from launching shells, scripting hosts, or unsigned binaries.
Run Cobalt under a standard user account rather than an administrative account to limit blast radius.
Educate CAD users on the risk of opening unsolicited XE files received via email or external file shares.

Patch Information

At the time of NVD publication, no vendor patch URL is listed in the advisory data. Refer to the Zero Day Initiative Advisory ZDI-25-725 and the Ashlar-Vellum support channel for the latest fixed build. Apply the vendor update to all Cobalt installations as soon as it becomes available.

Workarounds

Block inbound XE files at email and web proxy gateways until a vendor patch is deployed.
Open untrusted CAD files inside an isolated virtual machine or sandbox with no access to production data.
Disable file association handlers that automatically launch Cobalt when an XE file is double-clicked from untrusted locations.

bash

# Example: block .xe attachments at an Exchange transport rule (PowerShell)
New-TransportRule -Name "Block Ashlar XE Files" \
  -AttachmentExtensionMatchesWords "xe" \
  -RejectMessageReasonText "XE attachments blocked pending CVE-2025-8006 patch"