CVE-2023-35711 is a high severity untrusted pointer dereference in the way Ashlar-Vellum Cobalt parses XE files. Opening a crafted file or visiting a malicious page can lead to code execution. The ZDI advisory lists the fix as version 12.6.1204.217, so update and treat unknown CAD files with care.
What's affected
The record lists Ashlar-Vellum Cobalt 12.0.1204.59. The Zero Day Initiative advisory ZDI-23-874 names Cobalt and lists the mitigation as version 12.6.1204.217. Check Ashlar-Vellum's own release notes to confirm the exact build for your edition.
The sources disagree on severity. The record carries 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). ZDI scores it 7.0 using CVSS 3.0 with a higher attack complexity (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Both are High. The record's KEV flag is false.
How to check if you're exposed
- Open Cobalt and read the version in the Help or About dialog. Compare it with 12.6.1204.217.
- Search your software inventory for Ashlar-Vellum and Cobalt, including design workstations and any shared engineering images.
- List who exchanges Cobalt files with outside parties, because those users have the most exposure to files you did not make.
This is desktop CAD software, so a package manager query is not the right tool. Use your endpoint inventory.
What to do now
- Update Cobalt to 12.6.1204.217 or later, and confirm the exact fixed build with the vendor.
- Do not open Cobalt files from untrusted senders until you are patched.
- Run design software under a standard user account rather than an administrator account, so a code execution flaw runs with fewer rights.
- Keep recent backups of design data in a location the workstation cannot overwrite.
Why it matters
The weakness is CWE-822, untrusted pointer dereference. The parser reads a value from the file and uses it as a memory address without checking it. A crafted file can steer the program to memory the attacker prepared, and code then runs in the context of the current process.
ZDI reports the vendor was told in February 2023 and said in June 2023 that a fix would come in a later build. The advisory was updated in 2026. If you rely on this product, put its updates on a regular schedule rather than waiting for a prompt.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why are there two scores?
The record uses 7.8 and ZDI uses 7.0, because they rate attack complexity differently. Both fall in the High range.
Does this need user action?
Yes. The target must open a malicious file or visit a malicious page, per the advisory.
Sources
Last reviewed: 19 October 2026.
