Ashlar-Vellum Cobalt AR file parsing heap-based buffer overflow enables remote code execution (CVE-2026-121743)
Original title: ZDI-26-873: (0Day) Ashlar-Vellum Cobalt AR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
ZDI-26-873 reports a heap-based buffer overflow in Ashlar-Vellum Cobalt AR file parsing that permits remote code execution with user interaction.
Remote attackers can execute arbitrary code on affected Ashlar-Vellum Cobalt installations by visiting a malicious page or opening a malicious file. The ZDI assigned a CVSS rating of 7.8 to this vulnerability.
- CVSS rating of 7.8
- User interaction required
- CVE-2026-121743 assigned
Impact: arbitrary code execution via malicious file parsing
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-121743 | — | — | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.