Ashlar-Vellum Cobalt Vulnerable to Remote Code Execution via VS File Parsing Flaw
A heap-based buffer overflow in Ashlar-Vellum Cobalt, tracked as CVE-2026-19781, allows remote attackers to execute arbitrary code by tricking users into opening malicious VS files.
A critical vulnerability has been identified in Ashlar-Vellum Cobalt, a software suite used for technical drawing and design, that permits remote code execution. The flaw, cataloged as ZDI-26-587 and assigned CVE-2026-19781, resides within the software's handling of its proprietary VS file format.
Exploitation of this vulnerability requires a user to interact with a malicious element. Specifically, an attacker could craft a malicious VS file or host a malicious webpage that, when accessed by a user running a vulnerable version of Ashlar-Vellum Cobalt, triggers the vulnerability. This user interaction is a key factor in the attack vector, suggesting that phishing or social engineering tactics could be employed to deliver the malicious payload.
The root cause of the vulnerability is a heap-based buffer overflow. This occurs because the software fails to adequately validate the size of user-supplied data before copying it into a buffer located on the heap. When an attacker provides data exceeding the buffer's allocated capacity, it can overwrite adjacent memory regions, leading to unpredictable behavior and potentially allowing for arbitrary code execution.
Successful exploitation would enable an attacker to execute code in the context of the current process. This means the malicious code would run with the same privileges as the Ashlar-Vellum Cobalt application itself. Depending on the user's privileges, this could lead to significant system compromise, including the ability to install programs, view, alter, or delete data, and create new accounts with full user rights.
The vulnerability carries a CVSS score of 7.8, classifying it as High severity. This score reflects the potential impact and the ease with which it can be exploited, although the requirement for user interaction slightly mitigates the overall risk compared to vulnerabilities exploitable without any user input.
Ashlar-Vellum has addressed this vulnerability by releasing version 12.6.1204.210 of Cobalt. Users of the affected software are strongly advised to update to this patched version as soon as possible to mitigate the risk of exploitation.
The vulnerability was initially reported to the vendor on November 11, 2025. Following a coordinated disclosure process, the advisory was publicly released on August 24, 2026, providing details about the flaw and its resolution. The research leading to the discovery of this vulnerability is credited to Rocco Calvi of TecSecurity.