ZDI-26-870: Ashlar-Vellum Cobalt XE stack buffer overflow RCE
Original title: ZDI-26-870: (0Day) Ashlar-Vellum Cobalt XE File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
Ashlar-Vellum Cobalt XE file parsing vulnerability allows remote code execution with user interaction; ZDI assigned CVSS 7.8.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-121744.
- 0-day stack-based buffer overflow in file parsing
- Remote code execution requires user interaction
- CVSS rating 7.8
- CVE-2026-121744 assigned
Impact: Remote code execution
| Product | Affected |
|---|---|
| Ashlar-Vellum Cobalt XE | — |
- 1.Apply vendor patches when released
- CVEs
- CVE-2026-121744
- Vendors
- Ashlar-Vellum
- Products
- Cobalt XE
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-121744 | — | — | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.