ZDI-26-587: Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
ZDI advisory ZDI-26-587 details a heap-based buffer overflow RCE (CVE-2026-19781, CVSS 7.8) in Ashlar-Vellum Cobalt VS file parsing, requiring user interaction.
The Zero Day Initiative released advisory ZDI-26-587 covering a heap-based buffer overflow in Ashlar-Vellum Cobalt's VS file parsing. A remote attacker can execute arbitrary code when the target opens a malicious file or visits a crafted page. ZDI rated the vulnerability CVSS 7.8 and assigned CVE-2026-19781.
12