Ashlar-Vellum Cobalt XE file parsing use-after-free enables remote code execution (CVE-2026-121753)
Original title: ZDI-26-872: (0Day) Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability
ZDI-26-872 discloses a use-after-free in Ashlar-Vellum Cobalt XE file parsing that enables arbitrary code execution with user interaction.
Remote attackers can execute arbitrary code on affected Ashlar-Vellum Cobalt installations by visiting a malicious page or opening a malicious file. The ZDI assigned a CVSS rating of 7.8 to this vulnerability.
- CVSS rating of 7.8
- User interaction required
- CVE-2026-121753 assigned
Impact: arbitrary code execution via malicious file parsing
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-121753 | — | — | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.