PT-2025-1449 · Ashlar Vellum · Ashlar-Vellum Cobalt

Michael Heinzl · Published 2023-08-10 · Updated 2025-02-05 · CVE-2023-40222

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200)

Description The affected application lacks proper validation of user-supplied data when parsing CO files, which could lead to a heap-based buffer overflow. An attacker could leverage this issue to execute arbitrary code in the context of the current process.

Recommendations For versions prior to v12 SP2 Build (1204.200), update to v12 SP2 Build (1204.200) or later to resolve the issue. As a temporary workaround, consider restricting the parsing of CO files from untrusted sources until a patch is applied.

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

BDU:2025-01779

CVE-2023-40222

Affected Products

Ashlar-Vellum Cobalt

References · 9

• https://osv.dev/vulnerability/CVE-2023-40222 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01779 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-40222 · Security Note
• https://t.me/cvedetector/17266 · Telegram Post
• https://vuldb.com/ru/?id.294693 · Note
• https://t.me/cvenotify/110035 · Telegram Post
• https://twitter.com/CVEnew/status/1886915999053603054 · Twitter Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-299-03 · Note
• https://twitter.com/CveFindCom/status/1886905292845113813 · Twitter Post