CVE-2023-34288 is an uninitialized pointer flaw in the way Ashlar-Vellum Cobalt parses XE files, scored 7.8 High by NVD. Opening a malicious file can lead to code execution as the current user. ZDI says Cobalt 12.0.1204.54 fixes it, so update and avoid untrusted files.
What's affected
The record lists Ashlar-Vellum Cobalt as affected, without a version range. The ZDI advisory says the issue is fixed in Cobalt version 12.0.1204.54. Earlier builds should be treated as vulnerable. The flaw is in the parsing of XE files.
ZDI reported the issue to the vendor on 27 July 2022 and released the advisory on 8 June 2023, which is a long gap between report and public fix information.
How to check if you're exposed
This is desktop software, so look at the installed version rather than at a network port. Open the application's About dialog, or on Windows open Settings, then Apps, and read the version shown for the product.
If you manage a fleet, ask your software inventory or endpoint tool for every machine with the product installed, plus the version. Include design workstations, shared drives with install media and virtual machines, since these are easy to miss.
Also list where the file types in question arrive from. Drawings often come by email from suppliers and clients, so a mail attachment filter that logs the extension in question is a useful source of evidence.
What to do now
- Update Ashlar-Vellum Cobalt to version 12.0.1204.54 or later, the fixed release named in the ZDI advisory.
- Until you have updated, do not open XE files from outside sources. Ask suppliers and clients to send neutral formats where they can.
- Handle drawings from untrusted senders in a separate account or virtual machine without access to shared drives.
- Tell design staff about the risk in plain words: a file that looks like a drawing can be the attack.
- Add the software to your asset list with its version so the next advisory is a lookup.
Why it matters
The parser uses a pointer before setting it to a valid value. What the pointer happens to contain depends on earlier memory use, and an attacker who controls the file can shape that. The advisory says code runs in the context of the current process, so the damage is bounded by the rights of the user who opened the file.
CAD files are a natural carrier. They are shared between companies, opened by people who rely on them, and parsed by complex code.
The weakness classes involved are CWE-824 (Access of Uninitialized Pointer). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Source conflict: NVD scores this CVE 7.8. The ZDI advisory page I fetched did not give a score for this ID, and the sibling Cobalt advisory ZDI-23-831 lists 7.0 with a local, high complexity vector. Check the advisory for the current figure.
Quick check
Do I need to be attacked over the network?
No. The attacker needs a user to open a malicious file or visit a malicious page, so the weakness is reached through the file the application parses.
What is the safest habit meanwhile?
Treat unexpected XE files as untrusted and open them only after the update is installed.
Sources
Last reviewed: 19 October 2026.
