Ashlar-Vellum Cobalt AR File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of AR files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-20630.
The specific flaw exists within the parsing of AR files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-20630.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Ashlar |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-46563 | Ashlar-Vellum Cobalt AR File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of AR files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-20630. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-1453/ |
|
History
Fri, 08 Aug 2025 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:ashlar:cobalt:12.0.1204.61:*:*:*:*:*:*:* |
Tue, 08 Jul 2025 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:ashlar:cobalt:1204.61:*:*:*:*:*:*:* |
Thu, 19 Sep 2024 02:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Ashlar
Ashlar cobalt |
|
| CPEs | cpe:2.3:a:ashlar:cobalt:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Ashlar
Ashlar cobalt |
|
| Metrics |
ssvc
|
Wed, 18 Sep 2024 18:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Ashlar-Vellum Cobalt AR File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of AR files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20630. | Ashlar-Vellum Cobalt AR File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of AR files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-20630. |
MITRE
Status: PUBLISHED
Assigner: zdi
Published:
Updated: 2024-09-18T18:30:07.691Z
Reserved: 2023-09-06T21:14:24.433Z
Link: CVE-2023-42104
Vulnrichment
Updated: 2024-08-02T19:16:50.178Z
NVD
Status : Analyzed
Published: 2024-05-03T03:15:48.163
Modified: 2025-08-08T17:25:20.523
Link: CVE-2023-42104
Redhat
No data.
OpenCVE Enrichment
No data.