CVE-2023-34293 is an out-of-bounds write in the way Ashlar-Vellum Cobalt parses X_B and X_T files, scored 8.8 High by NVD. A user who opens a malicious file can give the attacker code execution. ZDI says Cobalt 12.0.1204.54 fixes it, so update.
What's affected
The record lists Ashlar-Vellum Cobalt as affected, without a version range. The ZDI advisory says the issue is fixed in Cobalt version 12.0.1204.54. The flaw is in the parsing of X_B and X_T files, which are exchange formats for solid models.
The issue was reported to the vendor on 14 September 2022 and the advisory came out on 8 June 2023.
How to check if you're exposed
This is desktop software, so look at the installed version rather than at a network port. Open the application's About dialog, or on Windows open Settings, then Apps, and read the version shown for the product.
If you manage a fleet, ask your software inventory or endpoint tool for every machine with the product installed, plus the version. Include design workstations, shared drives with install media and virtual machines, since these are easy to miss.
Also list where the file types in question arrive from. Drawings often come by email from suppliers and clients, so a mail attachment filter that logs the extension in question is a useful source of evidence.
What to do now
- Update Ashlar-Vellum Cobalt to version 12.0.1204.54 or later, the fixed release named in the ZDI advisory.
- Until you have updated, do not open X_B or X_T files from outside sources. Ask suppliers and clients to send neutral formats where they can.
- Handle drawings from untrusted senders in a separate account or virtual machine without access to shared drives.
- Tell design staff about the risk in plain words: a file that looks like a drawing can be the attack.
- Add the software to your asset list with its version so the next advisory is a lookup.
Why it matters
The parser writes past the end of an allocated buffer because it does not validate values taken from the file. Out-of-bounds writes are a common route to code execution because the attacker can often influence what gets written and where.
The code runs with the privileges of the person who opened the file. On engineering workstations those privileges often include access to design archives and shared drives.
The weakness classes involved are CWE-787 (Out-of-bounds Write). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Source conflict: NVD scores this CVE 8.8 with a network vector (AV:N). The ZDI advisory lists 7.0 with a local, high complexity vector (AV:L/AC:H). Both are shown here. The advisory says user interaction is needed either way.
Quick check
Do I need to be attacked over the network?
No. The attacker needs a user to open a malicious file or visit a malicious page, so the weakness is reached through the file the application parses.
What is the safest habit meanwhile?
Treat unexpected X_B or X_T files as untrusted and open them only after the update is installed.
Sources
Last reviewed: 19 October 2026.
