Zero-Day Vulnerability in Ashlar-Vellum Cobalt XE Allows Remote Code Execution
A use-after-free vulnerability in Ashlar-Vellum Cobalt XE, disclosed by Zero Day Initiative, allows remote attackers to execute arbitrary code.
A critical use-after-free vulnerability has been discovered in Ashlar-Vellum Cobalt XE, a software product from Ashlar-Vellum. This flaw, identified as ZDI-26-874 and assigned CVE-2026-121742, permits remote attackers to achieve arbitrary code execution on vulnerable systems. The exploitation of this vulnerability requires a degree of user interaction, typically involving the victim visiting a malicious webpage or opening a specially crafted file.
The vulnerability stems from an issue within the file parsing component of Cobalt XE. Specifically, the software fails to adequately validate the existence of an object before attempting to perform operations on it. This oversight allows an attacker to manipulate the program's state, leading to the execution of malicious code within the context of the current process. The CVSS score for this vulnerability is rated at 7.8, indicating a high severity.
The Zero Day Initiative (ZDI) reported the vulnerability to Ashlar-Vellum on February 6, 2026. The vendor acknowledged the report on the same day. Following standard disclosure timelines, ZDI followed up with the vendor on multiple occasions, including July 13 and August 6, 2026, to inquire about the status of a patch. As no patch was available by October 29, 2026, ZDI notified the vendor of their intention to publish an advisory, classifying it as a zero-day disclosure.
Given the nature of the vulnerability, which relies on the parsing of XE files and requires user interaction, the primary mitigation strategy recommended is to restrict user interaction with the product. This could involve implementing stricter controls on file handling and web browsing for users of Cobalt XE, or limiting the product's exposure to untrusted sources.
This vulnerability highlights the ongoing risks associated with complex software, particularly in specialized industries. File parsing libraries are frequent targets for attackers due to the inherent complexity and the potential for subtle errors in handling malformed or malicious inputs. The successful exploitation of such flaws can have severe consequences, including complete system compromise.
The coordinated public release of the advisory occurred on November 4, 2026, coinciding with the update of the advisory itself. The discovery and reporting of this vulnerability are credited to Rocco Calvi, who works with TecSecurity. This disclosure serves as a reminder for users and vendors to remain vigilant regarding software security and to prioritize timely patching and robust security practices.
This advisory, ZDI-26-870, details a stack-based buffer overflow vulnerability in Ashlar-Vellum Cobalt XE, distinct from the previously reported use-after-free flaw. The new vulnerability, CVE-2026-121744, also allows for remote code execution but requires user interaction, such as opening a crafted file or visiting a malicious webpage. The disclosure timeline indicates a lengthy vendor response period, with the vulnerability reported in November 2025 and publicly disclosed in November 2026.
This advisory, ZDI-26-872, specifically details a use-after-free vulnerability within Ashlar-Vellum Cobalt XE's file parsing mechanism, identified as CVE-2026-121753. While the previous report broadly covered remote code execution in Cobalt XE, this new information pinpoints the exact vulnerability type and its CVSS score of 7.8, emphasizing that user interaction via a malicious file or webpage is required for exploitation.