---
id: "CVE-2026-121743"
page: "https://infrastack.ai/live/CVE-2026-121743"
kind: "vulnerability"
aliases: ["CVE-2026-121743"]
title: "Ashlar-Vellum Cobalt: crafted AR file can run code, no fix yet (0-day)"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Ashlar-Vellum Cobalt", "fixed": [], "affected": "1204.209 (per NVD; other builds unknown)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ashlar-vellum", "cad", "cobalt", "desktop", "file-parsing", "other", "user-interaction", "zero-day"]
not_affected_if: ["cobalt-not-installed", "not-installed"]
published_at: "2026-11-12T03:17:10+00:00"
first_seen_at: "2026-11-12T03:46:13+00:00"
updated_at: "2026-11-12T03:49:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121743", "first_seen_at": "2026-11-12T03:46:13+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-873/", "first_seen_at": "2026-11-12T03:49:39+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-873/", "https://nvd.nist.gov/vuln/detail/CVE-2026-121743"]}]
exploit_sources: []
---

# Ashlar-Vellum Cobalt: crafted AR file can run code, no fix yet (0-day)

Link for people: https://infrastack.ai/live/CVE-2026-121743 (this .md is for agents)

ZDI-26-873 (published 2026-11-04 as a 0-day): heap buffer overflow when Cobalt parses AR files; length of data is not validated before copying to a heap buffer. Opening a malicious AR file (or visiting a page that delivers one) can run code as the Cobalt process. Reported to the vendor 2026-01-22; on 2026-07-15 the vendor said the fix was not complete. ZDI lists no fix. No exploitation or public PoC reported in the sources.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Ashlar-Vellum Cobalt affected 1204.209 (per NVD; other builds unknown) fixed no fixed version listed

## How to check

Check whether Ashlar-Vellum Cobalt is installed (Help > About for the build). NVD lists build 1204.209 as affected; ZDI gives no version list. Earlier AR-parsing bugs were fixed in 12.0.1204.54, so older builds are likely affected too, but that is not stated for this CVE.

## Fix

No vendor fix known as of ZDI-26-873 (2026-11-04). ZDI's only mitigation: restrict interaction with the product, i.e. do not open AR files from untrusted sources.

## Timeline

- 2026-11-12T03:46:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121743
- 2026-11-12T03:49:39+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-873/ — ZDI-26-873 read; 0-day, vendor fix not completed per ZDI timeline; affected build 1204.209 from NVD CVE record. No vendor page found. Not marked verified (ZDI is not vendor).

## Documents

- [advisory] ZDI-26-873 Ashlar-Vellum Cobalt AR File Parsing Heap-based Buffer Overflow https://www.zerodayinitiative.com/advisories/ZDI-26-873/
- [describes] NVD CVE-2026-121743 https://nvd.nist.gov/vuln/detail/CVE-2026-121743

## From the sources

Ashlar-Vellum Cobalt AR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of AR files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28675.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_