Ashlar-Vellum Cobalt XE File Parsing Uninitialized Memory Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of XE files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-20201.
The specific flaw exists within the parsing of XE files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process.
. Was ZDI-CAN-20201.
Metrics
Affected Vendors & Products
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-39712 | Ashlar-Vellum Cobalt XE File Parsing Uninitialized Memory Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-20201. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-23-876/ |
|
History
Sat, 09 Aug 2025 01:30:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:ashlar:cobalt:12.0.1204.59:*:*:*:*:*:*:* |
Fri, 08 Aug 2025 00:45:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:ashlar:cobalt:1204.59:*:*:*:*:*:*:* |
Fri, 20 Sep 2024 05:30:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Ashlar
Ashlar cobalt |
|
| CPEs | cpe:2.3:a:ashlar:cobalt:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Ashlar
Ashlar cobalt |
|
| Metrics |
ssvc
|
Thu, 19 Sep 2024 03:45:00 +0900
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Ashlar-Vellum Cobalt XE File Parsing Uninitialized Memory Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20201. | Ashlar-Vellum Cobalt XE File Parsing Uninitialized Memory Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XE files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-20201. |
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: zdi
Published:
Updated: 2024-09-18T18:28:50.058Z
Reserved: 2023-06-15T20:23:02.751Z
Link: CVE-2023-35713
Vulnrichment
Updated: 2024-08-02T16:30:45.353Z
NVD
Status : Analyzed
Published: 2024-05-03T02:15:33.610
Modified: 2025-08-08T16:29:05.700
Link: CVE-2023-35713
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses