PT-2025-1446 · Ashlar Vellum · Ashlar-Vellum Cobalt

Michael Heinzl · Published 2023-08-10 · Updated 2025-02-05 · CVE-2023-39943

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200)

Description The affected application lacks proper validation of user-supplied data when parsing XE files, which could lead to an out-of-bounds write. An attacker could leverage this issue to execute arbitrary code in the context of the current process.

Recommendations For versions prior to v12 SP2 Build (1204.200), update to v12 SP2 Build (1204.200) or later to resolve the issue. As a temporary workaround, consider restricting the parsing of XE files until a patch is applied.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2025-01788

CVE-2023-39943

Affected Products

Ashlar-Vellum Cobalt

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-39943 · Security Note
• https://osv.dev/vulnerability/CVE-2023-39943 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01788 · Security Note
• https://t.me/cvedetector/17265 · Telegram Post
• https://twitter.com/CVEnew/status/1886915998235656537 · Twitter Post
• https://vuldb.com/ru/?id.294692 · Note
• https://twitter.com/CveFindCom/status/1886905318979883333 · Twitter Post
• https://t.me/cvenotify/110034 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-299-03 · Note