CVE-2025-7991

Executive Summary

CVE-2025-7991 is a critical out-of-bounds read vulnerability in Ashlar-Vellum Cobalt, a computer-aided design (CAD) application. The flaw resides in the parsing of VC6 files, where insufficient validation of user-supplied data allows an attacker to read past the end of an allocated data structure. This can be leveraged to achieve remote code execution (RCE) in the context of the current process. The vulnerability requires user interaction—the target must open a malicious VC6 file or visit a malicious page. With a CVSS score of 7.8, this poses a significant risk to users of the software, especially in environments where untrusted CAD files are exchanged. No public exploit code or patch is currently available, making detection and mitigation critical.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector (AV): Local (L) – exploitation requires the attacker to deliver a malicious file locally.
• Attack Complexity (AC): Low (L) – no special conditions beyond user interaction.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): Required (R) – the victim must open the file.
• Scope (S): Unchanged (U) – the vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – potential for full data exposure.
• Integrity (I): High (H) – arbitrary code execution can modify data.
• Availability (A): High (H) – code execution can lead to denial of service.

Threat Level: Critical. The lack of a patch and the potential for code execution in a widely used CAD tool makes this a high-priority threat for organizations in engineering, manufacturing, and design sectors.

Deep Dive & Mechanics

The vulnerability is a classic out-of-bounds read (CWE-125) in the VC6 file parser of Ashlar-Vellum Cobalt. VC6 files are binary CAD files containing geometric and metadata structures. The parser fails to properly validate the length of user-supplied data when reading from an allocated buffer. By crafting a VC6 file with a manipulated header or data field that specifies an incorrect size, an attacker can cause the parser to read beyond the allocated memory boundary.

This out-of-bounds read can lead to:

• Information Disclosure: Leakage of sensitive memory contents, such as pointers or other data.
• Remote Code Execution: If the read data is used in a subsequent operation (e.g., as a function pointer or jump target), an attacker can control execution flow. The ZDI report (ZDI-CAN-25945) confirms that this can be leveraged for code execution in the context of the current process.

The attack surface is limited to user interaction, but in enterprise environments where CAD files are frequently shared, the risk is elevated. The vulnerability does not require network access; it is triggered locally when the file is opened.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, the vulnerable code likely resembles:

// Vulnerable pseudo-code
void parse_vc6_data(char *buffer, size_t size) {
    uint32_t data_length = *(uint32_t*)buffer; // Attacker-controlled
    char *data = buffer + 4;
    // No check: data_length may exceed actual buffer size
    process_data(data, data_length); // Out-of-bounds read
}

A patched version would include a bounds check:

// Patched pseudo-code
void parse_vc6_data(char *buffer, size_t size) {
    if (size < 4) return;
    uint32_t data_length = *(uint32_t*)buffer;
    if (data_length > size - 4) return; // Bounds check
    char *data = buffer + 4;
    process_data(data, data_length);
}

Until an official patch is released, users must rely on mitigations.

Exploitation & Lab Setup

Red Team (Exploitation)

No public exploit code is available. However, a proof-of-concept could be developed by:

1. Crafting a Malicious VC6 File: Modify a legitimate VC6 file to include a manipulated length field in a data chunk (e.g., a vertex or face array). Set the length to a value larger than the actual data, causing an out-of-bounds read.
2. Triggering the Vulnerability: Open the file in Ashlar-Vellum Cobalt. The parser will read past the buffer, potentially leaking memory or executing arbitrary code if the read data is used as a pointer.
3. Achieving Code Execution: If the out-of-bounds read includes a controlled pointer (e.g., from heap spray), an attacker can redirect execution to shellcode.

Lab Setup:

• Victim: Windows 10/11 with Ashlar-Vellum Cobalt (any version).
• Attacker: Kali Linux with Python for file crafting.
• Tool: Use a hex editor or Python script to modify VC6 file structures.

# Example script to craft a malicious VC6 file (conceptual)
import struct

def craft_malicious_vc6():
    # Legitimate VC6 header
    header = b'\x56\x43\x36'  # "VC6" magic
    # Malicious chunk: set length to 0xFFFFFFFF
    chunk_type = b'\x01\x00'  # Example chunk type
    chunk_length = struct.pack('<I', 0xFFFFFFFF)  # Out-of-bounds
    payload = b'A' * 100  # Minimal data
    malicious_file = header + chunk_type + chunk_length + payload
    with open('malicious.vc6', 'wb') as f:
        f.write(malicious_file)

craft_malicious_vc6()

Blue Team (Detection & Defense)

• User Awareness: Train users not to open VC6 files from untrusted sources.
• File Scanning: Use antivirus/EDR solutions to scan VC6 files for anomalies (e.g., oversized length fields).
• Sandboxing: Open CAD files in isolated environments or virtual machines.
• Application Control: Restrict execution of Ashlar-Vellum Cobalt to trusted users and systems.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): None available; monitor for suspicious VC6 files.
• Network Traffic: Unusual outbound connections from the Cobalt process (post-exploitation).
• Process Behavior: Cobalt.exe reading excessive memory or crashing with access violations.
• Registry/File System: Creation of unknown DLLs or scripts in temporary directories.
• YARA Rule (see Detection Engineering): Detects malicious VC6 files with oversized length fields.

Detection Engineering

YARA Rule

rule CVE_2025_7991_Ashlar_Vellum_VC6_OOB_Read {
    meta:
        description = "Detects malicious VC6 files exploiting CVE-2025-7991 out-of-bounds read"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-7991"
    strings:
        $magic = { 56 43 36 } // "VC6" magic bytes
        $suspicious_length = { FF FF FF FF } // 0xFFFFFFFF length field
    condition:
        $magic at 0 and $suspicious_length
}

Sigma Rule

title: CVE-2025-7991 Ashlar-Vellum Cobalt VC6 File Parsing OOB Read
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2025-7991 via process crashes or memory access violations in Cobalt.exe
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\Cobalt.exe'
        CommandLine|contains: '.vc6'
    condition: selection
falsepositives:
    - Legitimate use of VC6 files
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-7991 Ashlar-Vellum Cobalt VC6 OOB Read Exploit"; flow:to_server,established; content:"VC6"; offset:0; depth:3; content:"|FF FF FF FF|"; within:10; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable or restrict the use of Ashlar-Vellum Cobalt until a patch is available.
• Workaround: Use file validation tools to check VC6 files for anomalous length fields before opening.
• Vendor Contact: Monitor Ashlar-Vellum’s website for updates. If no patch is forthcoming, consider migrating to alternative CAD software.
• Long-term: Implement application whitelisting and endpoint detection and response (EDR) to monitor for exploitation attempts.

Valters IT – Securing your digital assets with precision.