Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows an attacker to execute code in the context of Ashlar-Vellum Cobalt after a user opens a malicious VS file or visits a malicious page.

The VS file parser copies attacker-controlled data into a heap-based buffer without first validating its length, resulting in a heap-based buffer overflow. Ashlar-Vellum fixed the issue in version 12.6.1204.210.