Zero-Day Vulnerability in Ashlar-Vellum Cobalt Allows Remote Code Execution
A heap-based buffer overflow in Ashlar-Vellum Cobalt, disclosed by Zero Day Initiative, allows remote attackers to execute arbitrary code by tricking users into opening malicious files or visiting malicious websites.
Zero Day Initiative (ZDI) has disclosed a critical remote code execution vulnerability, identified as ZDI-26-871 and CVE-2026-121752, affecting Ashlar-Vellum Cobalt. The vulnerability is a heap-based buffer overflow that can be triggered by attackers who trick a user into opening a specially crafted LI file or visiting a malicious webpage.
The specific flaw lies within the LI file parsing component of Ashlar-Vellum Cobalt. Attackers can exploit this by providing malformed input that exceeds the allocated buffer size on the heap. This overflow allows for the injection and execution of arbitrary code within the context of the current process, granting the attacker significant control over the affected system.
Exploitation of this vulnerability requires user interaction. This means a potential victim must be socially engineered into opening a malicious file or navigating to a compromised website that hosts the exploit. Despite the user interaction requirement, the potential impact is severe, as successful exploitation can lead to complete system compromise.
The vulnerability carries a CVSS score of 7.8, classifying it as high severity. This score reflects the potential for remote exploitation and the significant impact of arbitrary code execution. The disclosure timeline indicates that ZDI first reported the vulnerability to the vendor on December 4, 2025, with updates and a final public release on November 4, 2026, indicating a year-long disclosure process.
As this vulnerability was disclosed as a zero-day, there is currently no patch available from Ashlar-Vellum. The only recommended mitigation strategy provided by ZDI is to restrict user interaction with the product, particularly concerning opening untrusted files or visiting unknown websites. This highlights the importance of user education and robust endpoint security measures.
The vulnerability was discovered and reported by Rocco Calvi of TecSecurity. The coordinated public release of this advisory serves to inform users and administrators about the risks and to encourage vendors to expedite patching processes when such vulnerabilities are identified.
This disclosure underscores the ongoing threat posed by complex software vulnerabilities, particularly in specialized design and engineering applications. Users of Ashlar-Vellum Cobalt are strongly advised to remain vigilant and to apply any future patches or security updates as soon as they become available.
This advisory provides further technical details on the heap-based buffer overflow in Ashlar-Vellum Cobalt, identified as CVE-2026-121743. The vulnerability stems from improper validation of user-supplied data length during AR file parsing, allowing remote code execution in the context of the current process. The disclosure timeline indicates the vulnerability was reported on January 22, 2026, and the vendor acknowledged it shortly after, with coordinated public release occurring on November 4, 2026.