{"id":"CVE-2026-121742","kind":"vulnerability","aliases":["CVE-2026-121742"],"related":[],"title":"Ashlar-Vellum Cobalt: crafted XE file lets attackers run code","description":"Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XE files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28757.","summary":"Ashlar-Vellum Cobalt mishandles objects while parsing XE files, a use-after-free that lets a remote attacker run arbitrary code in the current process. The victim must open a malicious file or visit a malicious page for it to trigger.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Ashlar-Vellum Cobalt","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ashlar-vellum","cobalt","desktop","other","user-interaction","windows"],"not_affected_if":["no-cobalt-installed"],"how_to_check":"Affected versions are not published. Check whether Ashlar-Vellum Cobalt is installed on Windows workstations and whether staff open XE files from outside sources.","fix":"No vendor fix known. ZDI-26-872 is a 0-day advisory; the vendor said on 2026-07-15 the fix was not completed. Check Ashlar-Vellum for a newer Cobalt build.","status":"open","published_at":"2026-11-12T03:17:10+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","triaged_at":"2026-11-12T03:47:30+00:00","updated_at":"2026-11-12T03:49:49+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-12T03:47:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Ashlar-Vellum Cobalt: crafted XE file lets attackers run code","impact":"high","summary":"Ashlar-Vellum Cobalt mishandles objects while parsing XE files, a use-after-free that lets a remote attacker run arbitrary code in the current process. The victim must open a malicious file or visit a malicious page for it to trigger.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ashlar-vellum","cobalt","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"code runs in the context of the Cobalt process","analyst_note":"Check the ZDI advisory for ZDI-CAN-28757 and the vendor page for affected versions and a fixed build; the NVD entry gave neither.","how_to_check":"unknown","plain_action":"","product_name":"Ashlar-Vellum Cobalt","needs_analyst":true,"not_affected_if":["no-cobalt-installed"],"who_is_affected":"Organizations that run Ashlar-Vellum Cobalt and open XE files, including files received from outside sources. The sources do not give affected versions or configuration details, so teams should confirm whether they use Cobalt with XE files. Teams that do not run Cobalt can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000723,"input_tokens":4669,"output_tokens":512,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the ZDI advisory for ZDI-CAN-28757 and the vendor page for affected versions and a fixed build; the NVD entry gave neither.","search":"'-121742':14A,17A '-2026':13A,16A '28757':179C 'affect':100C 'allow':92C 'arbitrari':53B,97C 'ashlar':2A,19A,23B,33B,76C,104C 'ashlar-vellum':1A,18A,22B,32B,75C,103C 'attack':9A,51B,94C,160C 'cobalt':4A,21A,25B,35B,78C,106C 'code':11A,54B,87C,98C,167C 'context':170C 'craft':5A 'current':57B,173C 'cve':12A,15A 'desktop':26B 'execut':88C,96C,166C 'exist':132C,148C 'exploit':112C 'file':7A,41B,65B,80C,128C,138C 'flaw':131C 'free':46B,85C 'instal':101C 'interact':30B,108C 'issu':140C 'lack':144C 'let':8A,48B 'leverag':162C 'malici':64B,69B,122C,127C 'mishandl':36B 'must':61B,119C 'object':37B,151C,158C 'open':62B,125C 'oper':155C 'page':70B,123C 'pars':39B,81C,135C 'perform':154C 'prior':152C 'process':58B,174C 'remot':50B,86C,93C 'requir':110C 'result':141C 'run':10A,52B 'specif':130C 'target':118C 'trigger':74B 'use':44B,83C 'use-after-fre':43B,82C 'user':29B,107C 'user-interact':28B 'valid':146C 'vellum':3A,20A,24B,34B,77C,105C 'victim':60B 'visit':67B,120C 'vulner':89C,91C,114C,164C 'window':31B 'within':133C 'xe':6A,40B,79C,137C 'zdi':177C 'zdi-can':176C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Ashlar-Vellum Cobalt (CAD software on Windows) who opens an XE file from an untrusted source. The attack needs the user to open a malicious file or visit a malicious page. Teams that don't use Cobalt can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ashlarvellumcobalt","cobalt"],"ptokens":["ashlar","cobalt","vellum"],"labels":["ashlarvellum","cobalt","desktop","high","other","userinteraction","vendor","windows"],"campaign_type":null,"search_a":"'-121742':14A,17A '-2026':13A,16A 'ashlar':2A,19A 'ashlar-vellum':1A,18A 'attack':9A 'cobalt':4A,21A 'code':11A 'craft':5A 'cve':12A,15A 'file':7A 'let':8A 'run':10A 'vellum':3A,20A 'xe':6A","search_b":"'arbitrari':53B 'ashlar':23B,33B 'ashlar-vellum':22B,32B 'attack':51B 'cobalt':25B,35B 'code':54B 'current':57B 'desktop':26B 'file':41B,65B 'free':46B 'interact':30B 'let':48B 'malici':64B,69B 'mishandl':36B 'must':61B 'object':37B 'open':62B 'page':70B 'pars':39B 'process':58B 'remot':50B 'run':52B 'trigger':74B 'use':44B 'use-after-fre':43B 'user':29B 'user-interact':28B 'vellum':24B,34B 'victim':60B 'visit':67B 'window':31B 'xe':40B","search_c":"'28757':179C 'affect':100C 'allow':92C 'arbitrari':97C 'ashlar':76C,104C 'ashlar-vellum':75C,103C 'attack':94C,160C 'cobalt':78C,106C 'code':87C,98C,167C 'context':170C 'current':173C 'execut':88C,96C,166C 'exist':132C,148C 'exploit':112C 'file':80C,128C,138C 'flaw':131C 'free':85C 'instal':101C 'interact':108C 'issu':140C 'lack':144C 'leverag':162C 'malici':122C,127C 'must':119C 'object':151C,158C 'open':125C 'oper':155C 'page':123C 'pars':81C,135C 'perform':154C 'prior':152C 'process':174C 'remot':86C,93C 'requir':110C 'result':141C 'specif':130C 'target':118C 'use':83C 'use-after-fre':82C 'user':107C 'valid':146C 'vellum':77C,105C 'visit':120C 'vulner':89C,91C,114C,164C 'within':133C 'xe':79C,137C 'zdi':177C 'zdi-can':176C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121742","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121742","severity":null,"published_at":"2026-11-12T03:17:10+00:00","modified_at":"2026-11-12T03:17:10+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","fetched_at":"2026-11-12T03:46:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121742:3686","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-872/","severity":null,"published_at":"2026-11-12T03:49:49+00:00","modified_at":"2026-11-12T03:49:49+00:00","first_seen_at":"2026-11-12T03:49:49+00:00","fetched_at":"2026-11-12T03:49:49+00:00","note":"ZDI-26-872 (0day, published 2026-11-04) is the likely advisory for this CVE (XE use-after-free); the page doesn't show the ZDI-CAN id or CVE, so the mapping is unconfirmed (several sibling XE advisories exist). Vendor had not finished a fix as of 2026-07-15; no fixed version or affected range published. ZDI's only mitigation: restrict interaction with the product (don't open untrusted XE files). Nothing verified.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-872/"]}],"documents":[{"id":131535,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-872/","title":"ZDI-26-872 Ashlar-Vellum Cobalt XE File Parsing Use-After-Free RCE (0-day)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}