Vulnerability Research & Exploit Development on TecSecurity Research

AzeoTech DAQFactory CTL File Parsing Use-After-Free Remote Code Execution Vulnerability

Thu, 23 Jul 2026 12:00:00 +1000

This vulnerability allows remote attackers to execute arbitrary code on affected installations of AzeoTech DAQFactory. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CTL files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process.

ZDI-CAN-30702 - NVIDIA Vulnerability (Upcoming)

Wed, 22 Jul 2026 12:00:00 +1000

This vulnerability is currently pending vendor remediation. Full technical details will be published following coordinated disclosure.

Rockwell Automation Arena Simulation DOE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Wed, 15 Jul 2026 12:00:00 +1000

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Rockwell Automation Arena Simulation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DOE files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process.

Siemens Simcenter Femap IPT File Parsing Memory Corruption Remote Code Execution Vulnerability

Tue, 12 May 2026 12:00:00 +1000

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Simcenter Femap. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of IPT files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process.

Siemens Simcenter Femap IPT File Parsing Memory Corruption Remote Code Execution Vulnerability

Tue, 12 May 2026 12:00:00 +1000

Siemens SINEC NMS Improper Authentication Privilege Escalation Vulnerability

Thu, 23 Apr 2026 12:00:00 +1000

This vulnerability allows remote attackers to escalate privileges on affected installations of Siemens SINEC NMS. Authentication is required to exploit this vulnerability.

The specific flaw exists within the web service listening on TCP port 443. The issue results from improper authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to escalate privileges to access protected resources.

NI LabVIEW LVCLASS File Parsing Memory Corruption Remote Code Execution Vulnerability

Wed, 15 Apr 2026 12:00:00 +1000

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NI LabVIEW. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of LVCLASS files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process.

NI LabVIEW LVLIB File Parsing Memory Corruption Remote Code Execution Vulnerability

Wed, 15 Apr 2026 12:00:00 +1000

The specific flaw exists within the parsing of LVLIB files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process.

Digilent DASYLab DSA File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Mon, 30 Mar 2026 12:00:00 +1100

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Digilent DASYLab. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DSA files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.

Digilent DASYLab DSA File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Mon, 30 Mar 2026 12:00:00 +1100

Digilent DASYLab DSA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Mon, 30 Mar 2026 12:00:00 +1100

The specific flaw exists within the parsing of DSA files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.

Autodesk AutoCAD CATPART File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Wed, 18 Feb 2026 12:00:00 +1100

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk AutoCAD. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CATPART files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Autodesk AutoCAD MODEL File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Wed, 18 Feb 2026 12:00:00 +1100

The specific flaw exists within the parsing of MODEL files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability

Thu, 12 Feb 2026 12:00:00 +1100

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Schneider Electric EcoStruxure Power Build. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of SSD files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process.

Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability

Thu, 12 Feb 2026 12:00:00 +1100

Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability

Thu, 12 Feb 2026 12:00:00 +1100

Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability

Thu, 12 Feb 2026 12:00:00 +1100

Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability

Thu, 12 Feb 2026 12:00:00 +1100

Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability

Thu, 12 Feb 2026 12:00:00 +1100

Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability

Thu, 12 Feb 2026 12:00:00 +1100

Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability

Thu, 12 Feb 2026 12:00:00 +1100

Schneider Electric EcoStruxure Power Build SSD File Parsing Memory Corruption Remote Code Execution Vulnerability

Thu, 12 Feb 2026 12:00:00 +1100

Schneider Electric EcoStruxure Power Build SSD File Parsing Use-After-Free Remote Code Execution Vulnerability

Thu, 12 Feb 2026 12:00:00 +1100

The specific flaw exists within the parsing of SSD files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process.

Schneider Electric EcoStruxure Power Build SSD File Parsing Use-After-Free Remote Code Execution Vulnerability

Thu, 12 Feb 2026 12:00:00 +1100

ZDI-CAN-28757 - Ashlar-Vellum Vulnerability (Upcoming)

Fri, 06 Feb 2026 12:00:00 +1100

This vulnerability is currently pending vendor remediation. Full details will be published following coordinated disclosure.

AzeoTech DAQFactory Pro CTL File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Tue, 03 Feb 2026 12:00:00 +1100

The specific flaw exists within the parsing of CTL files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

ZDI-CAN-28675 - Ashlar-Vellum Vulnerability (Upcoming)

Thu, 22 Jan 2026 12:00:00 +1100

This vulnerability is currently pending vendor remediation. Full details will be published following coordinated disclosure.

AzeoTech DAQFactory CTL File Parsing Memory Corruption Remote Code Execution Vulnerability

Fri, 19 Dec 2025 12:00:00 +1100

The specific flaw exists within the parsing of CTL files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process.

AzeoTech DAQFactory CTL File Parsing Memory Corruption Remote Code Execution Vulnerability

Fri, 19 Dec 2025 12:00:00 +1100

AzeoTech DAQFactory CTL File Parsing Memory Corruption Remote Code Execution Vulnerability

Fri, 19 Dec 2025 12:00:00 +1100

AzeoTech DAQFactory CTL File Parsing Memory Corruption Remote Code Execution Vulnerability

Fri, 19 Dec 2025 12:00:00 +1100

Autodesk AutoCAD CATPART File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Wed, 17 Dec 2025 12:00:00 +1100

The specific flaw exists within the parsing of CATPART files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process.

AzeoTech DAQFactory CTL File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Wed, 17 Dec 2025 12:00:00 +1100

The specific flaw exists within the parsing of CTL files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process.

AzeoTech DAQFactory CTL File Parsing Type Confusion Remote Code Execution Vulnerability

Wed, 17 Dec 2025 12:00:00 +1100

The specific flaw exists within the parsing of CTL files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process.

AzeoTech DAQFactory CTL File Parsing Type Confusion Remote Code Execution Vulnerability

Wed, 17 Dec 2025 12:00:00 +1100

Fuji Electric Monitouch V-SFT V7 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Wed, 17 Dec 2025 12:00:00 +1100

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of V7 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process.

Fuji Electric Monitouch V-SFT V7 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Wed, 17 Dec 2025 12:00:00 +1100

The specific flaw exists within the parsing of V7 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Fuji Electric Monitouch V-SFT V7 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Wed, 17 Dec 2025 12:00:00 +1100

The specific flaw exists within the parsing of V7 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Fuji Electric Monitouch V-SFT V7 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Wed, 17 Dec 2025 12:00:00 +1100

Siemens Simcenter Femap SLDPRT File Parsing Uninitialized Memory Remote Code Execution Vulnerability

Wed, 17 Dec 2025 12:00:00 +1100

The specific flaw exists within the parsing of SDLPRT files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process.

ZDI-CAN-28587 - Ashlar-Vellum Vulnerability (Upcoming)

Tue, 16 Dec 2025 12:00:00 +1100

This vulnerability is currently pending vendor remediation. Full details will be published following coordinated disclosure.

(0Day) Soda PDF Desktop PDF File Parsing Memory Corruption Information Disclosure Vulnerability

Thu, 11 Dec 2025 12:00:00 +1100

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.

(0Day) Soda PDF Desktop PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Thu, 11 Dec 2025 12:00:00 +1100

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process.

(0Day) Soda PDF Desktop PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Thu, 11 Dec 2025 12:00:00 +1100

(0Day) Soda PDF Desktop PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Thu, 11 Dec 2025 12:00:00 +1100

(0Day) Soda PDF Desktop PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Thu, 11 Dec 2025 12:00:00 +1100

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Soda PDF Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Fuji Electric Monitouch V-SFT V7 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Wed, 10 Dec 2025 12:00:00 +1100

The specific flaw exists within the parsing of V7 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Fuji Electric Monitouch V-SFT V7 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Wed, 10 Dec 2025 12:00:00 +1100

Fuji Electric Monitouch V-SFT V7 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Wed, 10 Dec 2025 12:00:00 +1100

The specific flaw exists within the parsing of V7 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Fuji Electric Monitouch V-SFT V7 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Wed, 10 Dec 2025 12:00:00 +1100

The specific flaw exists within the parsing of V7 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Fuji Electric Monitouch V-SFT V7 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Wed, 10 Dec 2025 12:00:00 +1100

The specific flaw exists within the parsing of V7 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Fuji Electric Monitouch V-SFT V7 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Wed, 10 Dec 2025 12:00:00 +1100

The specific flaw exists within the parsing of V7 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Fuji Electric Monitouch V-SFT V7 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Wed, 10 Dec 2025 12:00:00 +1100

The specific flaw exists within the parsing of V7 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Siemens Simcenter Femap IGS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Tue, 09 Dec 2025 12:00:00 +1100

The specific flaw exists within the parsing of IGS files. The issue results from the lack of proper validation of user-supplied data, which can result in a read before the start of an allocated array. An attacker can leverage this vulnerability to execute code in the context of the current process.

ZDI-CAN-28447 - Ashlar-Vellum Vulnerability (Upcoming)

Thu, 04 Dec 2025 12:00:00 +1100

This vulnerability is currently pending vendor remediation. Full details will be published following coordinated disclosure.

ZDI-CAN-28172 - Ashlar-Vellum Vulnerability (Upcoming)

Tue, 11 Nov 2025 12:00:00 +1100

This vulnerability is currently pending vendor remediation. Full details will be published following coordinated disclosure.

ZDI-CAN-28173 - Ashlar-Vellum Vulnerability (Upcoming)

Tue, 11 Nov 2025 12:00:00 +1100

This vulnerability is currently pending vendor remediation. Full details will be published following coordinated disclosure.

(0Day) Ashlar-Vellum Cobalt CO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Thu, 16 Oct 2025 12:00:00 +1100

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt CO File Parsing Use-After-Free Remote Code Execution Vulnerability

Thu, 16 Oct 2025 12:00:00 +1100

The specific flaw exists within the parsing of CO files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt XE File Parsing Integer Overflow Remote Code Execution Vulnerability

Thu, 16 Oct 2025 12:00:00 +1100

The specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Siemens Simcenter Femap STP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Fri, 12 Sep 2025 12:00:00 +1100

The specific flaw exists within the parsing of STP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

Siemens Simcenter Femap NEU File Parsing Type Confusion Remote Code Execution Vulnerability

Thu, 28 Aug 2025 12:00:00 +1100

The specific flaw exists within the parsing of NEU files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process.

Siemens Simcenter Femap NEU File Parsing Type Confusion Remote Code Execution Vulnerability

Thu, 28 Aug 2025 12:00:00 +1100

Siemens Simcenter Femap NEU File Parsing Type Confusion Remote Code Execution Vulnerability

Thu, 28 Aug 2025 12:00:00 +1100

ZDI Vanguard Award 2025: Most Prolific Researcher

Fri, 08 Aug 2025 10:00:00 +1100

At Black Hat USA 2025, Trend Micro’s Zero Day Initiative presented the ZDI Vanguard Award to TecSecurity founder Rocco Calvi (@TecR0c) for Most Prolific Researcher – recognising the researcher with the highest number of contracted vulnerability cases with ZDI. The award was presented at Trend Micro’s booth as part of ZDI’s 20th anniversary celebrations.

By the Numbers

The award reflects over 300 remote code execution vulnerabilities reported to ZDI across a range of target categories:

NI LabVIEW VI File Parsing Memory Corruption Remote Code Execution Vulnerability

Fri, 01 Aug 2025 12:00:00 +1100

The specific flaw exists within the parsing of VI files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process.

NI LabVIEW VI File Parsing Memory Corruption Remote Code Execution Vulnerability

Fri, 01 Aug 2025 12:00:00 +1100

(0Day) Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Wed, 30 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of AR files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Wed, 30 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of AR files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt AR File Parsing Type Confusion Remote Code Execution Vulnerability

Wed, 30 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of AR files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt CO File Parsing Memory Corruption Remote Code Execution Vulnerability

Wed, 30 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Wed, 30 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Wed, 30 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability

Wed, 30 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of CO files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability

Wed, 30 Jul 2025 12:00:00 +1100

(0Day) Ashlar-Vellum Cobalt LI File Parsing Type Confusion Remote Code Execution Vulnerability

Wed, 30 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of LI files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt LI File Parsing Use-After-Free Remote Code Execution Vulnerability

Wed, 30 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of LI files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Wed, 30 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of user-supplied data, which can result in a read before the start of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Wed, 30 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Wed, 30 Jul 2025 12:00:00 +1100

(0Day) Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability

Wed, 30 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process.

Autodesk AutoCAD 3DM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Tue, 29 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of 3DM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Tue, 22 Jul 2025 12:00:00 +1100

(0Day) Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Tue, 22 Jul 2025 12:00:00 +1100

(0Day) Ashlar-Vellum Cobalt AR File Parsing Uninitialized Variable Remote Code Execution Vulnerability

Tue, 22 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of AR files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt LI File Parsing Integer Overflow Remote Code Execution Vulnerability

Tue, 22 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of LI files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt LI File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Tue, 22 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of LI files. The issue results from the lack of proper validation of user-supplied data, which can result in a read before the start of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt VC6 File Parsing Integer Overflow Remote Code Execution Vulnerability

Tue, 22 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

Tue, 22 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Tue, 22 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Tue, 22 Jul 2025 12:00:00 +1100

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Graphite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Tue, 22 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Tue, 22 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Tue, 22 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Graphite VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Tue, 22 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Graphite VC6 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Tue, 22 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability

Tue, 22 Jul 2025 12:00:00 +1100

The specific flaw exists within the parsing of VC6 files. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process.

(0Day) Ashlar-Vellum Graphite VC6 File Parsing Uninitialized Variable Remote Code Execution Vulnerability

Tue, 22 Jul 2025 12:00:00 +1100

IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability