CVE-2023-39943

High

Published: 04 February 2025

Published

04 February 2025

Modified

16 September 2025

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0013 32.5th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-39943 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Ashlar Cobalt. Its CVSS base score is 7.8 (High).

Operationally, ranked at the 32.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly addresses the lack of proper validation of user-supplied data in XE files, preventing out-of-bounds writes during parsing.

SI-2 Flaw Remediation good match

prevent

Mandates timely flaw remediation by updating to the patched version v12 SP2 Build (1204.200), eliminating the vulnerability.

SI-16 Memory Protection partial match

prevent

Provides memory protections like DEP and ASLR to mitigate exploitation of out-of-bounds writes for arbitrary code execution.

NVD Description

In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code…

in the context of the current process.

Deeper analysisAI

CVE-2023-39943 is a vulnerability in Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), where the application fails to properly validate user-supplied data during XE file parsing. This flaw, classified under CWE-787 (Out-of-bounds Write), can result in an out-of-bounds write condition. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.

A local attacker can exploit this vulnerability by crafting a malicious XE file and tricking a user into opening it within the affected application, requiring no privileges (PR:N) and low complexity (AC:L), though user interaction is necessary (UI:R). Successful exploitation enables arbitrary code execution in the context of the current process, granting the attacker high levels of control over confidentiality, integrity, and availability.

Mitigation guidance is available in the CISA ICS Advisory ICSA-23-299-03, accessible at https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-03.