Zetlyn
GitHubGet started

Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to…

cve CVE-2025-7998 1 source, 1 claim · Watch

NVD writes:
Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to … the claim
Vendor
Ashlar-Vellum NVD
Product
Cobalt NVD
CWE
CWE-787 NVD

How far exploitation has got

  1. No public code known
  2. Proof of concept
  3. Proof of concept, verified
  4. A Metasploit module
  5. Exploited in the wild
  6. Used in ransomware campaigns

Timeline

2025-09-17first spoke of it: Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26046.NVD

Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26046.

What it is to other things

affectsashlar/cobalt
NVD
made_byashlar
NVD

In words only, so not counted until a person confirms one:

made_byashlar_vellum
NVD says “Ashlar-Vellum”
affectsashlar_vellum/cobalt
NVD says “Ashlar-Vellum · Cobalt”
Every value, with what each source said and its receipt
PropertySourceSaidMeans here
Automatable
automatable
NVDno
At least one of those steps needs a person.
receipt
Source
NVD
Its words
no
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].automatable
Said since
2026-10-06 11:54 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 11:54 UTCno
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unknown",
            "product": "Cobalt",
            "vendor": "Ashlar-Vellum",
            "versions": [
              {
                "status": "affected",
                "version": "12 SP1"
              }
            ]
          }
        ],
        "source": "zdi-disclosures@trendmicro.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:ashlar:cobalt:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "E32EB61C-3C4E-43EB-A583-AF54646ACC44",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26046."
      },
      {
        "lang": "es",
        "value": "Vulnerabilidad de ejecución remota de código por escritura fuera de límites en el análisis de archivos CO de Ashlar-Vellum Cobalt. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Ashlar-Vellum Cobalt. Se requiere interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\n\nLa falla específica reside en el análisis de archivos CO. El problema se debe a la falta de validación adecuada de los datos proporcionados por el usuario, lo que puede resultar en una escritura fuera de los límites de una estructura de datos asignada. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Fue ZDI-CAN-26046."
      }
    ],
    "id": "CVE-2025-7998",
    "lastModified": "2026-09-26T00:10:00.127",
    "metrics": {
      "cvssMetricV30": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "zdi-disclosures@trendmicro.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-7998",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-18T13:54:20.125504Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-17T21:15:41.763",
    "references": [
      {
        "source": "zdi-disclosures@trendmicro.com",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-715/"
      }
    ],
    "sourceIdentifier": "zdi-disclosures@trendmicro.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "zdi-disclosures@trendmicro.com",
        "type": "Secondary"
      }
    ]
  }
}
—
CWE
cwe
NVDCWE-787
receipt
Source
NVD
Its words
CWE-787
Read by
field:cve.weaknesses[].description[].value
Said since
2026-10-06 11:54 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 11:54 UTCCWE-787
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unknown",
            "product": "Cobalt",
            "vendor": "Ashlar-Vellum",
            "versions": [
              {
                "status": "affected",
                "version": "12 SP1"
              }
            ]
          }
        ],
        "source": "zdi-disclosures@trendmicro.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:ashlar:cobalt:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "E32EB61C-3C4E-43EB-A583-AF54646ACC44",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26046."
      },
      {
        "lang": "es",
        "value": "Vulnerabilidad de ejecución remota de código por escritura fuera de límites en el análisis de archivos CO de Ashlar-Vellum Cobalt. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Ashlar-Vellum Cobalt. Se requiere interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\n\nLa falla específica reside en el análisis de archivos CO. El problema se debe a la falta de validación adecuada de los datos proporcionados por el usuario, lo que puede resultar en una escritura fuera de los límites de una estructura de datos asignada. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Fue ZDI-CAN-26046."
      }
    ],
    "id": "CVE-2025-7998",
    "lastModified": "2026-09-26T00:10:00.127",
    "metrics": {
      "cvssMetricV30": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "zdi-disclosures@trendmicro.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-7998",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-18T13:54:20.125504Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-17T21:15:41.763",
    "references": [
      {
        "source": "zdi-disclosures@trendmicro.com",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-715/"
      }
    ],
    "sourceIdentifier": "zdi-disclosures@trendmicro.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "zdi-disclosures@trendmicro.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Exploitation
exploitation
NVDnone
No evidence of exploitation, and no public proof of concept.
receipt
Source
NVD
Its words
none
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].exploitation
Said since
2026-10-06 11:54 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 11:54 UTCnone
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unknown",
            "product": "Cobalt",
            "vendor": "Ashlar-Vellum",
            "versions": [
              {
                "status": "affected",
                "version": "12 SP1"
              }
            ]
          }
        ],
        "source": "zdi-disclosures@trendmicro.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:ashlar:cobalt:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "E32EB61C-3C4E-43EB-A583-AF54646ACC44",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26046."
      },
      {
        "lang": "es",
        "value": "Vulnerabilidad de ejecución remota de código por escritura fuera de límites en el análisis de archivos CO de Ashlar-Vellum Cobalt. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Ashlar-Vellum Cobalt. Se requiere interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\n\nLa falla específica reside en el análisis de archivos CO. El problema se debe a la falta de validación adecuada de los datos proporcionados por el usuario, lo que puede resultar en una escritura fuera de los límites de una estructura de datos asignada. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Fue ZDI-CAN-26046."
      }
    ],
    "id": "CVE-2025-7998",
    "lastModified": "2026-09-26T00:10:00.127",
    "metrics": {
      "cvssMetricV30": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "zdi-disclosures@trendmicro.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-7998",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-18T13:54:20.125504Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-17T21:15:41.763",
    "references": [
      {
        "source": "zdi-disclosures@trendmicro.com",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-715/"
      }
    ],
    "sourceIdentifier": "zdi-disclosures@trendmicro.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "zdi-disclosures@trendmicro.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Product
product
NVDCobalt
receipt
Source
NVD
Its words
Cobalt
Read by
field:cve.affected[].affectedData[].product
Said since
2026-09-29 17:49 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-09-29 17:49 UTCCobalt
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unknown",
            "product": "Cobalt",
            "vendor": "Ashlar-Vellum",
            "versions": [
              {
                "status": "affected",
                "version": "12 SP1"
              }
            ]
          }
        ],
        "source": "zdi-disclosures@trendmicro.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:ashlar:cobalt:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "E32EB61C-3C4E-43EB-A583-AF54646ACC44",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26046."
      },
      {
        "lang": "es",
        "value": "Vulnerabilidad de ejecución remota de código por escritura fuera de límites en el análisis de archivos CO de Ashlar-Vellum Cobalt. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Ashlar-Vellum Cobalt. Se requiere interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\n\nLa falla específica reside en el análisis de archivos CO. El problema se debe a la falta de validación adecuada de los datos proporcionados por el usuario, lo que puede resultar en una escritura fuera de los límites de una estructura de datos asignada. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Fue ZDI-CAN-26046."
      }
    ],
    "id": "CVE-2025-7998",
    "lastModified": "2026-09-26T00:10:00.127",
    "metrics": {
      "cvssMetricV30": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "zdi-disclosures@trendmicro.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-7998",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-18T13:54:20.125504Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-17T21:15:41.763",
    "references": [
      {
        "source": "zdi-disclosures@trendmicro.com",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-715/"
      }
    ],
    "sourceIdentifier": "zdi-disclosures@trendmicro.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "zdi-disclosures@trendmicro.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Status
status
NVDAnalyzed
receipt
Source
NVD
Its words
Analyzed
Read by
field:cve.vulnStatus
Said since
2026-09-29 09:45 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unknown",
            "product": "Cobalt",
            "vendor": "Ashlar-Vellum",
            "versions": [
              {
                "status": "affected",
                "version": "12 SP1"
              }
            ]
          }
        ],
        "source": "zdi-disclosures@trendmicro.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:ashlar:cobalt:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "E32EB61C-3C4E-43EB-A583-AF54646ACC44",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26046."
      },
      {
        "lang": "es",
        "value": "Vulnerabilidad de ejecución remota de código por escritura fuera de límites en el análisis de archivos CO de Ashlar-Vellum Cobalt. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Ashlar-Vellum Cobalt. Se requiere interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\n\nLa falla específica reside en el análisis de archivos CO. El problema se debe a la falta de validación adecuada de los datos proporcionados por el usuario, lo que puede resultar en una escritura fuera de los límites de una estructura de datos asignada. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Fue ZDI-CAN-26046."
      }
    ],
    "id": "CVE-2025-7998",
    "lastModified": "2026-09-26T00:10:00.127",
    "metrics": {
      "cvssMetricV30": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "zdi-disclosures@trendmicro.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-7998",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-18T13:54:20.125504Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-17T21:15:41.763",
    "references": [
      {
        "source": "zdi-disclosures@trendmicro.com",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-715/"
      }
    ],
    "sourceIdentifier": "zdi-disclosures@trendmicro.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "zdi-disclosures@trendmicro.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Technical impact
technical_impact
NVDtotal
The attacker gains full control of the component, or all of its information.
receipt
Source
NVD
Its words
total
Read by
field:cve.metrics.ssvcV203[].ssvcData.options[].technicalImpact
Said since
2026-10-06 11:54 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-10-06 11:54 UTCtotal
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unknown",
            "product": "Cobalt",
            "vendor": "Ashlar-Vellum",
            "versions": [
              {
                "status": "affected",
                "version": "12 SP1"
              }
            ]
          }
        ],
        "source": "zdi-disclosures@trendmicro.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:ashlar:cobalt:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "E32EB61C-3C4E-43EB-A583-AF54646ACC44",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26046."
      },
      {
        "lang": "es",
        "value": "Vulnerabilidad de ejecución remota de código por escritura fuera de límites en el análisis de archivos CO de Ashlar-Vellum Cobalt. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Ashlar-Vellum Cobalt. Se requiere interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\n\nLa falla específica reside en el análisis de archivos CO. El problema se debe a la falta de validación adecuada de los datos proporcionados por el usuario, lo que puede resultar en una escritura fuera de los límites de una estructura de datos asignada. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Fue ZDI-CAN-26046."
      }
    ],
    "id": "CVE-2025-7998",
    "lastModified": "2026-09-26T00:10:00.127",
    "metrics": {
      "cvssMetricV30": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "zdi-disclosures@trendmicro.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-7998",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-18T13:54:20.125504Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-17T21:15:41.763",
    "references": [
      {
        "source": "zdi-disclosures@trendmicro.com",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-715/"
      }
    ],
    "sourceIdentifier": "zdi-disclosures@trendmicro.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "zdi-disclosures@trendmicro.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Vendor
vendor
NVDAshlar-Vellum
receipt
Source
NVD
Its words
Ashlar-Vellum
Read by
field:cve.affected[].affectedData[].vendor
Said since
2026-09-29 17:49 UTC
Last answered
2026-10-06 12:41 UTC
Original
open at the source
2026-09-29 17:49 UTCAshlar-Vellum
2026-09-29 09:45 UTC—
What the source handed over
{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unknown",
            "product": "Cobalt",
            "vendor": "Ashlar-Vellum",
            "versions": [
              {
                "status": "affected",
                "version": "12 SP1"
              }
            ]
          }
        ],
        "source": "zdi-disclosures@trendmicro.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:ashlar:cobalt:-:*:*:*:*:*:*:*",
                "matchCriteriaId": "E32EB61C-3C4E-43EB-A583-AF54646ACC44",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26046."
      },
      {
        "lang": "es",
        "value": "Vulnerabilidad de ejecución remota de código por escritura fuera de límites en el análisis de archivos CO de Ashlar-Vellum Cobalt. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Ashlar-Vellum Cobalt. Se requiere interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\n\nLa falla específica reside en el análisis de archivos CO. El problema se debe a la falta de validación adecuada de los datos proporcionados por el usuario, lo que puede resultar en una escritura fuera de los límites de una estructura de datos asignada. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Fue ZDI-CAN-26046."
      }
    ],
    "id": "CVE-2025-7998",
    "lastModified": "2026-09-26T00:10:00.127",
    "metrics": {
      "cvssMetricV30": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "zdi-disclosures@trendmicro.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2025-7998",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "no"
              },
              {
                "technicalImpact": "total"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2025-09-18T13:54:20.125504Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2025-09-17T21:15:41.763",
    "references": [
      {
        "source": "zdi-disclosures@trendmicro.com",
        "tags": [
          "Third Party Advisory"
        ],
        "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-715/"
      }
    ],
    "sourceIdentifier": "zdi-disclosures@trendmicro.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-787"
          }
        ],
        "source": "zdi-disclosures@trendmicro.com",
        "type": "Secondary"
      }
    ]
  }
}
—
Every claim, by kind

vulnerability

Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26046.
zetlyn/cve-nvd · 2025-09-17
automatable no cwe CWE-787 exploitation none product Cobalt status Analyzed technical_impact total vendor Ashlar-Vellum source