---
id: "CVE-2026-121742"
page: "https://infrastack.ai/live/CVE-2026-121742"
kind: "vulnerability"
aliases: ["CVE-2026-121742"]
title: "Ashlar-Vellum Cobalt: crafted XE file lets attackers run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Ashlar-Vellum Cobalt", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ashlar-vellum", "cobalt", "desktop", "other", "user-interaction", "windows"]
not_affected_if: ["no-cobalt-installed"]
published_at: "2026-11-12T03:17:10+00:00"
first_seen_at: "2026-11-12T03:46:13+00:00"
updated_at: "2026-11-12T03:49:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121742", "first_seen_at": "2026-11-12T03:46:13+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-872/", "first_seen_at": "2026-11-12T03:49:49+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-872/"]}]
exploit_sources: []
---

# Ashlar-Vellum Cobalt: crafted XE file lets attackers run code

Link for people: https://infrastack.ai/live/CVE-2026-121742 (this .md is for agents)

Ashlar-Vellum Cobalt mishandles objects while parsing XE files, a use-after-free that lets a remote attacker run arbitrary code in the current process. The victim must open a malicious file or visit a malicious page for it to trigger.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Ashlar-Vellum Cobalt affected range not listed fixed no fixed version listed

## How to check

Affected versions are not published. Check whether Ashlar-Vellum Cobalt is installed on Windows workstations and whether staff open XE files from outside sources.

## Fix

No vendor fix known. ZDI-26-872 is a 0-day advisory; the vendor said on 2026-07-15 the fix was not completed. Check Ashlar-Vellum for a newer Cobalt build.

## Timeline

- 2026-11-12T03:46:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121742
- 2026-11-12T03:49:49+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-872/ — ZDI-26-872 (0day, published 2026-11-04) is the likely advisory for this CVE (XE use-after-free); the page doesn't show the ZDI-CAN id or CVE, so the mapping is unconfirmed (several sibling XE advisories exist). Vendor had not finished a fix as of 2026-07-15; no fixed version or affected range published. ZDI's only mitigation: restrict interaction with the product (don't open untrusted XE files). Nothing verified.

## Documents

- [advisory] ZDI-26-872 Ashlar-Vellum Cobalt XE File Parsing Use-After-Free RCE (0-day) https://www.zerodayinitiative.com/advisories/ZDI-26-872/

## From the sources

Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XE files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28757.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_