CVE-2023-39943
Published: 04 February 2025
Summary
CVE-2023-39943 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Ashlar Cobalt. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 32.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2023-39943 is a vulnerability in Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), where the application fails to properly validate user-supplied data during XE file parsing. This flaw, classified under CWE-787 (Out-of-bounds Write), can result in an out-of-bounds write condition. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
A local attacker can exploit this vulnerability by crafting a malicious XE file and tricking a user into opening it within the affected application, requiring no privileges (PR:N) and low complexity (AC:L), though user interaction is necessary (UI:R). Successful exploitation enables arbitrary code execution in the context of the current process, granting the attacker high levels of control over confidentiality, integrity, and availability.
Mitigation guidance is available in the CISA ICS Advisory ICSA-23-299-03, accessible at https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-03.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-43641
Vulnerability details
In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of user-supplied data when parsing XE files. This could lead to an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code…
more
in the context of the current process.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in local file parser enables arbitrary code execution when user opens crafted malicious XE file (T1204.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the lack of proper validation of user-supplied data in XE files, preventing out-of-bounds writes during parsing.
Mandates timely flaw remediation by updating to the patched version v12 SP2 Build (1204.200), eliminating the vulnerability.
Provides memory protections like DEP and ASLR to mitigate exploitation of out-of-bounds writes for arbitrary code execution.