{"id":"CVE-2026-121743","kind":"vulnerability","aliases":["CVE-2026-121743"],"related":[],"title":"Ashlar-Vellum Cobalt: crafted AR file can run code, no fix yet (0-day)","description":"Ashlar-Vellum Cobalt AR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of AR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28675.","summary":"ZDI-26-873 (published 2026-11-04 as a 0-day): heap buffer overflow when Cobalt parses AR files; length of data is not validated before copying to a heap buffer. Opening a malicious AR file (or visiting a page that delivers one) can run code as the Cobalt process. Reported to the vendor 2026-01-22; on 2026-07-15 the vendor said the fix was not complete. ZDI lists no fix. No exploitation or public PoC reported in the sources.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Ashlar-Vellum Cobalt","fixed":[],"affected":"1204.209 (per NVD; other builds unknown)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ashlar-vellum","cad","cobalt","desktop","file-parsing","other","user-interaction","zero-day"],"not_affected_if":["cobalt-not-installed","not-installed"],"how_to_check":"Check whether Ashlar-Vellum Cobalt is installed (Help > About for the build). NVD lists build 1204.209 as affected; ZDI gives no version list. Earlier AR-parsing bugs were fixed in 12.0.1204.54, so older builds are likely affected too, but that is not stated for this CVE.","fix":"No vendor fix known as of ZDI-26-873 (2026-11-04). ZDI's only mitigation: restrict interaction with the product, i.e. do not open AR files from untrusted sources.","status":"open","published_at":"2026-11-12T03:17:10+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","triaged_at":"2026-11-12T03:47:30+00:00","updated_at":"2026-11-12T03:49:39+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-12T03:47:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Ashlar-Vellum Cobalt: crafted AR file lets attackers run code","impact":"high","summary":"Ashlar-Vellum Cobalt has a heap buffer overflow when parsing AR files, found by Zero Day Initiative (ZDI-CAN-28675). A remote attacker who gets a user to open a malicious file or visit a malicious page can execute arbitrary code in the context of the current process.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ashlar-vellum","cobalt","cad"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs in the context of the user's Cobalt process","analyst_note":"Find affected versions and vendor fix in the ZDI advisory or NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121743.","how_to_check":"unknown","plain_action":"","product_name":"Ashlar-Vellum Cobalt","needs_analyst":true,"not_affected_if":["cobalt-not-installed"],"who_is_affected":"Teams that run Ashlar-Vellum Cobalt and open AR files from untrusted sources are exposed. The sources do not name affected versions or configurations. Teams that do not use Cobalt can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00073,"input_tokens":4692,"output_tokens":522,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected versions and vendor fix in the ZDI advisory or NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121743.","search":"'-01':97B '-04':48B '-07':101B '-11':47B '-121743':18A,21A '-15':102B '-2026':17A,20A '-22':98B '-26':43B '-873':44B '0':14A,51B '2026':46B,96B,100B '28675':236C 'affect':150C 'allow':142C 'ar':6A,59B,76B,128C,187C 'arbitrari':147C 'ashlar':2A,23A,27B,125C,154C 'ashlar-vellum':1A,22A,26B,124C,153C 'attack':144C,217C 'base':133C,214C 'buffer':54B,72B,134C,215C 'cad':29B 'cobalt':4A,25A,30B,57B,90B,127C,156C 'code':10A,87B,137C,148C,224C 'complet':110B 'context':227C 'copi':68B,208C 'craft':5A 'current':230C 'cve':16A,19A 'data':63B,205C 'day':15A,41B,52B 'deliv':83B 'desktop':31B 'execut':138C,146C,223C 'exist':182C 'exploit':116B,162C 'file':7A,33B,60B,77B,129C,178C,188C 'file-pars':32B 'fix':12A,107B,114B 'flaw':181C 'heap':53B,71B,132C,213C 'heap-bas':131C,212C 'instal':151C 'interact':38B,158C 'issu':190C 'lack':194C 'length':61B,200C 'leverag':219C 'list':112B 'malici':75B,172C,177C 'must':169C 'one':84B 'open':73B,175C 'overflow':55B,135C 'page':81B,173C 'pars':34B,58B,130C,185C 'poc':119B 'prior':206C 'process':91B,231C 'proper':196C 'public':118B 'publish':45B 'remot':136C,143C 'report':92B,120B 'requir':160C 'result':191C 'run':9A,86B 'said':105B 'sourc':123B 'specif':180C 'suppli':204C 'target':168C 'user':37B,157C,203C 'user-interact':36B 'user-suppli':202C 'valid':66B,197C 'vellum':3A,24A,28B,126C,155C 'vendor':95B,104B 'visit':79B,170C 'vulner':139C,141C,164C,221C 'within':183C 'yet':13A 'zdi':42B,111B,234C 'zdi-can':233C 'zero':40B 'zero-day':39B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Ashlar-Vellum Cobalt and open AR files from untrusted sources are exposed. The sources do not name affected versions or configurations. Teams that do not use Cobalt can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["ashlarvellumcobalt","cobalt"],"ptokens":["ashlar","cobalt","vellum"],"labels":["ashlarvellum","cad","cobalt","desktop","fileparsing","high","other","userinteraction","vendor","zeroday"],"campaign_type":null,"search_a":"'-121743':18A,21A '-2026':17A,20A '0':14A 'ar':6A 'ashlar':2A,23A 'ashlar-vellum':1A,22A 'cobalt':4A,25A 'code':10A 'craft':5A 'cve':16A,19A 'day':15A 'file':7A 'fix':12A 'run':9A 'vellum':3A,24A 'yet':13A","search_b":"'-01':97B '-04':48B '-07':101B '-11':47B '-15':102B '-22':98B '-26':43B '-873':44B '0':51B '2026':46B,96B,100B 'ar':59B,76B 'ashlar':27B 'ashlar-vellum':26B 'buffer':54B,72B 'cad':29B 'cobalt':30B,57B,90B 'code':87B 'complet':110B 'copi':68B 'data':63B 'day':41B,52B 'deliv':83B 'desktop':31B 'exploit':116B 'file':33B,60B,77B 'file-pars':32B 'fix':107B,114B 'heap':53B,71B 'interact':38B 'length':61B 'list':112B 'malici':75B 'one':84B 'open':73B 'overflow':55B 'page':81B 'pars':34B,58B 'poc':119B 'process':91B 'public':118B 'publish':45B 'report':92B,120B 'run':86B 'said':105B 'sourc':123B 'user':37B 'user-interact':36B 'valid':66B 'vellum':28B 'vendor':95B,104B 'visit':79B 'zdi':42B,111B 'zero':40B 'zero-day':39B","search_c":"'28675':236C 'affect':150C 'allow':142C 'ar':128C,187C 'arbitrari':147C 'ashlar':125C,154C 'ashlar-vellum':124C,153C 'attack':144C,217C 'base':133C,214C 'buffer':134C,215C 'cobalt':127C,156C 'code':137C,148C,224C 'context':227C 'copi':208C 'current':230C 'data':205C 'execut':138C,146C,223C 'exist':182C 'exploit':162C 'file':129C,178C,188C 'flaw':181C 'heap':132C,213C 'heap-bas':131C,212C 'instal':151C 'interact':158C 'issu':190C 'lack':194C 'length':200C 'leverag':219C 'malici':172C,177C 'must':169C 'open':175C 'overflow':135C 'page':173C 'pars':130C,185C 'prior':206C 'process':231C 'proper':196C 'remot':136C,143C 'requir':160C 'result':191C 'specif':180C 'suppli':204C 'target':168C 'user':157C,203C 'user-suppli':202C 'valid':197C 'vellum':126C,155C 'visit':170C 'vulner':139C,141C,164C,221C 'within':183C 'zdi':234C 'zdi-can':233C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121743","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121743","severity":null,"published_at":"2026-11-12T03:17:10+00:00","modified_at":"2026-11-12T03:17:10+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","fetched_at":"2026-11-12T03:46:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121743:3685","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-873/","severity":null,"published_at":"2026-11-12T03:49:39+00:00","modified_at":"2026-11-12T03:49:39+00:00","first_seen_at":"2026-11-12T03:49:39+00:00","fetched_at":"2026-11-12T03:49:39+00:00","note":"ZDI-26-873 read; 0-day, vendor fix not completed per ZDI timeline; affected build 1204.209 from NVD CVE record. No vendor page found. Not marked verified (ZDI is not vendor).","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-873/","https://nvd.nist.gov/vuln/detail/CVE-2026-121743"]}],"documents":[{"id":131536,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-873/","title":"ZDI-26-873 Ashlar-Vellum Cobalt AR File Parsing Heap-based Buffer Overflow","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":131537,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121743","title":"NVD CVE-2026-121743","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}