ZDI discloses five unpatched Ashlar-Vellum Cobalt remote code execution bugs
No new Ashlar-Vellum facts since the November 4 advisories; patches and exploitation status remain unstated.
Five unpatched Ashlar-Vellum Cobalt file-parsing flaws can allow remote code execution if a user opens a malicious file or page.
On November 4, 2026, the Zero Day Initiative published five zero-day advisories for Ashlar-Vellum Cobalt file parsing. The flaws are a stack-based buffer overflow and two use-after-free bugs in XE parsing, plus heap-based buffer overflows in LI and AR parsing. Each can let a remote attacker execute arbitrary code if the user visits a malicious page or opens a malicious file. ZDI rated every issue CVSS 7.8 and assigned CVE-2026-121744, CVE-2026-121753, CVE-2026-121742, CVE-2026-121752, and CVE-2026-121743. No affected or fixed versions, patches, or exploitation in the wild are stated.
- Five Cobalt parsing bugs published as zero-days on November 4, 2026.
- XE issues: one stack overflow and two use-after-free bugs.
- LI and AR issues are heap-based buffer overflows.
- Each requires opening a malicious file or visiting a malicious page.
- ZDI rated all five CVSS 7.8; no patch or exploitation status is stated.
Timeline
dated events in the reporting · oldest first- Nov 4, 2026ZDI publishes five Cobalt file-parsing zero-day advisories. · ZDI Published Advisories
What each outlet adds
beyond the shared facts- ZDI Published AdvisoriesNames five Cobalt parsing bug classes, advisory IDs, and CVEs.
- CVEs
- CVE-2026-121752CVE-2026-121744CVE-2026-76181CVE-2026-88807CVE-2026-88806CVE-2026-121743CVE-2026-121742CVE-2026-121753CVE-2026-50256CVE-2026-50258CVE-2026-50264CVE-2025-10935
- Vendors
- Ashlar-VellumX.Org
- Organizations
- Zero Day Initiative
Coverage
oldest first · one row per article · UTC- · 6d ago
ZDI Published AdvisoriesFirst report
Ashlar-Vellum Cobalt AR file parsing heap-based buffer overflow enables remote code execution (CVE-2026-121743)
ZDI-26-873 reports a heap-based buffer overflow in Ashlar-Vellum Cobalt AR file parsing that permits remote code execution with user interaction.
- · 6d ago
ZDI-26-870: Ashlar-Vellum Cobalt XE stack buffer overflow RCE
Ashlar-Vellum Cobalt XE file parsing vulnerability allows remote code execution with user interaction; ZDI assigned CVSS 7.8.
- · 6d ago
Ashlar-Vellum Cobalt XE file parsing use-after-free enables remote code execution (CVE-2026-121742)
ZDI-26-874 discloses a use-after-free in Ashlar-Vellum Cobalt XE file parsing that enables arbitrary code execution with user interaction.
- · 6d ago
ZDI-26-871: Ashlar-Vellum Cobalt heap buffer overflow RCE
Ashlar-Vellum Cobalt LI file parsing vulnerability allows remote code execution with user interaction; ZDI assigned CVSS 7.8.
- · 6d ago
Ashlar-Vellum Cobalt XE file parsing use-after-free enables remote code execution (CVE-2026-121753)
ZDI-26-872 discloses a use-after-free in Ashlar-Vellum Cobalt XE file parsing that enables arbitrary code execution with user interaction.
- · 4d ago
libilbm ILBM parser heap overflow can execute code via a malicious file
CVE-2025-10935 requires the user to open a malicious file or page; ZDI scores it 7.8.
- · 4d ago
LibreOffice dBase parser heap overflow allows code execution
ZDI rates CVE-2026-76181 at CVSS 7.8 and says the target must open a malicious file or page.
- · 22h ago
X.Org libX11 XkbGetMap overflow allows remote code execution
A victim must connect to a malicious X11 server; ZDI rates CVE-2026-88806 at CVSS 8.8.
- · 22h ago
X.Org libXrender reply overflow allows remote code execution
Exploitation needs a connection to a malicious X11 server; ZDI rates CVE-2026-88807 at CVSS 8.8.
- · 22h ago
X.Org Server font alias overflow allows local privilege escalation
ZDI rates CVE-2026-50256 at 7.8; attackers must already run low-privileged code.
- · 22h ago
X.Org Server XkbResizeKeySyms overflow allows local privilege escalation
ZDI rates CVE-2026-50258 at 7.8 and says low-privileged code is required first.
- · 22h ago
X.Org Server ProcDRI2GetBuffers overflow allows local privilege escalation
ZDI rates CVE-2026-50264 at 7.8; exploitation needs prior low-privileged code execution.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-10935 | — | — | — | ||
| CVE-2026-121742 | — | — | — | ||
| CVE-2026-121743 | — | — | — | ||
| CVE-2026-121744 | — | — | — | ||
| CVE-2026-121752 | — | — | — | ||
| CVE-2026-121753 | — | — | — | ||
CVE-2026-50258+2 related CVEs | A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland | 7.8 | <1% | ||
| CVE-2026-76181 | Heap overflow in LibreOffice dBASE .ndx index parsing | 5.4 | — | ||
| CVE-2026-88806 | Buffer Overflow in libX11 XkbGetMap Leading to Potential Code Execution | 7.5 | — | ||
| CVE-2026-88807 | Heap Overflow in libXrender via Malicious X Server | 8.9 | — |