ZDI-26-871: Ashlar-Vellum Cobalt heap buffer overflow RCE
Original title: ZDI-26-871: (0Day) Ashlar-Vellum Cobalt LI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
Ashlar-Vellum Cobalt LI file parsing vulnerability allows remote code execution with user interaction; ZDI assigned CVSS 7.8.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-121752.
- 0-day heap-based buffer overflow in file parsing
- Remote code execution requires user interaction
- CVSS rating 7.8
- CVE-2026-121752 assigned
Impact: Remote code execution
| Product | Affected |
|---|---|
| Ashlar-Vellum Cobalt LI | — |
- 1.Apply vendor patches when released
- CVEs
- CVE-2026-121752
- Vendors
- Ashlar-Vellum
- Products
- Cobalt LI
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-121752 | — | — | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.