CVE-2025-7977
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious LI files or visiting malicious web pages. It affects Ashlar-Vellum Cobalt installations and exploits an out-of-bounds read during file parsing.
💻 Affected Systems
- Ashlar-Vellum Cobalt
📦 What is this software?
Cobalt by Ashlar
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the affected system and potentially pivoting to other systems.
Likely Case
Attacker executes code in the context of the current user, potentially stealing data, installing malware, or establishing persistence.
If Mitigated
Limited impact due to proper file validation, user awareness, and restricted execution environments.
🎯 Exploit Status
Exploitation requires social engineering to deliver malicious file/link
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific version
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-25-629/
Restart Required: Yes
Instructions:
1. Check Ashlar-Vellum website for security updates
2. Download and install latest Cobalt version
3. Restart application and verify patch installation
🔧 Temporary Workarounds
Restrict LI file execution
allBlock LI files from untrusted sources using application controls
User awareness training
allTrain users to avoid opening LI files from unknown sources
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized execution
- Use network segmentation to isolate vulnerable systems
🔍 How to Verify
Check if Vulnerable:
Check Cobalt version against vendor advisoryCheck Version:
Check application About menu or installation detailsVerify Fix Applied:
Verify installed version matches patched version from vendor📡 Detection & Monitoring
Log Indicators:
- Unexpected LI file processing
- Application crashes during file parsing
- Unusual process execution from Cobalt
Network Indicators:
- Downloads of LI files from untrusted sources
- Outbound connections from Cobalt to suspicious IPs
SIEM Query:
Process creation from cobalt.exe with suspicious parent process or command line