{"id":"CVE-2026-121744","kind":"vulnerability","aliases":["CVE-2026-121744"],"related":[],"title":"Ashlar-Vellum Cobalt: crafted XE file can run code, no fix available","description":"Ashlar-Vellum Cobalt XE File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28172.","summary":"ZDI published a 0-day: Cobalt copies data from XE files into a fixed stack buffer without checking its length (stack-based buffer overflow). A user who opens a crafted XE file, or visits a malicious page that leads to one, can let the attacker run code in the context of the Cobalt process. ZDI says the vendor has not released a fix; its only mitigation is to restrict interaction with the product.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Ashlar-Vellum Cobalt","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ashlar-vellum","cad","cobalt","file-parsing","no-fix","other","windows"],"not_affected_if":["no-untrusted-xe-files","no-xe-files-opened"],"how_to_check":"Check whether Ashlar-Vellum Cobalt is installed and which build. ZDI names no affected or fixed version, so treat installed builds as possibly affected until the vendor says otherwise. Check whether anyone opens .xe files from email, downloads or shared drives. Also check if you run Xenon or Argon (sibling Ashlar-Vellum products); no source says they are affected.","fix":"No vendor fix as of ZDI-26-870 (2026-11-04). No Ashlar-Vellum advisory found.","status":"open","published_at":"2026-11-12T03:17:10+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","triaged_at":"2026-11-12T03:47:29+00:00","updated_at":"2026-11-12T03:49:54+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-12T03:47:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Ashlar-Vellum Cobalt: crafted XE file lets attackers run code","impact":"high","summary":"Ashlar-Vellum Cobalt does not check the length of data read from XE files before copying it into a fixed stack buffer. An attacker who gets a user to open a malicious file or visit a malicious page can run arbitrary code in the context of the current process.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ashlar-vellum","cobalt","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary code in the Cobalt process","analyst_note":"Find the affected and fixed Cobalt versions and the vendor advisory, starting from https://nvd.nist.gov/vuln/detail/CVE-2026-121744 and the ZDI advisory for ZDI-CAN-28172.","how_to_check":"- Check whether Ashlar-Vellum Cobalt is installed on the machine and which version it is; the sources do not name the affected version range.\n- Confirm whether the application opens XE files from untrusted sources.","plain_action":"","product_name":"Ashlar-Vellum Cobalt","needs_analyst":true,"not_affected_if":["no-xe-files-opened"],"who_is_affected":"Teams that run Ashlar-Vellum Cobalt and open XE files from outside sources are exposed, since the user must open a malicious file or visit a malicious page. Installations that only handle trusted XE files are less exposed. The sources do not name affected versions.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000773,"input_tokens":4692,"output_tokens":608,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Cobalt versions and the vendor advisory, starting from https://nvd.nist.gov/vuln/detail/CVE-2026-121744 and the ZDI advisory for ZDI-CAN-28172.","search":"'-121744':16A,19A '-2026':15A,18A '0':40B '28172':223C 'affect':137C 'allow':129C 'arbitrari':134C 'ashlar':2A,21A,25B,112C,141C 'ashlar-vellum':1A,20A,24B,111C,140C 'attack':82B,131C,204C 'avail':13A 'base':59B,120C,201C 'buffer':52B,60B,121C,202C 'cad':27B 'check':54B 'cobalt':4A,23A,28B,42B,90B,114C,143C 'code':10A,84B,124C,135C,211C 'context':87B,214C 'copi':43B,195C 'craft':5A,67B 'current':217C 'cve':14A,17A 'data':44B,192C 'day':41B 'execut':125C,133C,210C 'exist':169C 'exploit':149C 'file':7A,30B,47B,69B,116C,165C,175C 'file-pars':29B 'fix':12A,34B,50B,100B 'flaw':168C 'instal':138C 'interact':107B,145C 'issu':177C 'lack':181C 'lead':76B 'length':56B,187C 'let':80B 'leverag':206C 'malici':73B,159C,164C 'mitig':103B 'must':156C 'no-fix':32B 'one':78B 'open':65B,162C 'overflow':61B,122C 'page':74B,160C 'pars':31B,117C,172C 'prior':193C 'process':91B,218C 'product':110B 'proper':183C 'publish':38B 'releas':98B 'remot':123C,130C 'requir':147C 'restrict':106B 'result':178C 'run':9A,83B 'say':93B 'specif':167C 'stack':51B,58B,119C,200C 'stack-bas':57B,118C,199C 'suppli':191C 'target':155C 'user':63B,144C,190C 'user-suppli':189C 'valid':184C 'vellum':3A,22A,26B,113C,142C 'vendor':95B 'visit':71B,157C 'vulner':126C,128C,151C,208C 'window':36B 'within':170C 'without':53B 'xe':6A,46B,68B,115C,174C 'zdi':37B,92B,221C 'zdi-can':220C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Ashlar-Vellum Cobalt and open XE files from outside sources are exposed, since the user must open a malicious file or visit a malicious page. Installations that only handle trusted XE files are less exposed. The sources do not name affected versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["ashlarvellumcobalt","cobalt"],"ptokens":["ashlar","cobalt","vellum"],"labels":["ashlarvellum","cad","cobalt","fileparsing","high","nofix","other","vendor","windows"],"campaign_type":null,"search_a":"'-121744':16A,19A '-2026':15A,18A 'ashlar':2A,21A 'ashlar-vellum':1A,20A 'avail':13A 'cobalt':4A,23A 'code':10A 'craft':5A 'cve':14A,17A 'file':7A 'fix':12A 'run':9A 'vellum':3A,22A 'xe':6A","search_b":"'0':40B 'ashlar':25B 'ashlar-vellum':24B 'attack':82B 'base':59B 'buffer':52B,60B 'cad':27B 'check':54B 'cobalt':28B,42B,90B 'code':84B 'context':87B 'copi':43B 'craft':67B 'data':44B 'day':41B 'file':30B,47B,69B 'file-pars':29B 'fix':34B,50B,100B 'interact':107B 'lead':76B 'length':56B 'let':80B 'malici':73B 'mitig':103B 'no-fix':32B 'one':78B 'open':65B 'overflow':61B 'page':74B 'pars':31B 'process':91B 'product':110B 'publish':38B 'releas':98B 'restrict':106B 'run':83B 'say':93B 'stack':51B,58B 'stack-bas':57B 'user':63B 'vellum':26B 'vendor':95B 'visit':71B 'window':36B 'without':53B 'xe':46B,68B 'zdi':37B,92B","search_c":"'28172':223C 'affect':137C 'allow':129C 'arbitrari':134C 'ashlar':112C,141C 'ashlar-vellum':111C,140C 'attack':131C,204C 'base':120C,201C 'buffer':121C,202C 'cobalt':114C,143C 'code':124C,135C,211C 'context':214C 'copi':195C 'current':217C 'data':192C 'execut':125C,133C,210C 'exist':169C 'exploit':149C 'file':116C,165C,175C 'flaw':168C 'instal':138C 'interact':145C 'issu':177C 'lack':181C 'length':187C 'leverag':206C 'malici':159C,164C 'must':156C 'open':162C 'overflow':122C 'page':160C 'pars':117C,172C 'prior':193C 'process':218C 'proper':183C 'remot':123C,130C 'requir':147C 'result':178C 'specif':167C 'stack':119C,200C 'stack-bas':118C,199C 'suppli':191C 'target':155C 'user':144C,190C 'user-suppli':189C 'valid':184C 'vellum':113C,142C 'visit':157C 'vulner':126C,128C,151C,208C 'within':170C 'xe':115C,174C 'zdi':221C 'zdi-can':220C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121744","severity":null,"published_at":"2026-11-12T03:17:10+00:00","modified_at":"2026-11-12T03:17:10+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","fetched_at":"2026-11-12T03:46:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121744:3684","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-870/","severity":null,"published_at":"2026-11-12T03:49:54+00:00","modified_at":"2026-11-12T03:49:54+00:00","first_seen_at":"2026-11-12T03:49:54+00:00","fetched_at":"2026-11-12T03:49:54+00:00","note":"ZDI-26-870 (0day, published 2026-11-04) read: no vendor fix, no affected version range given; vendor acknowledged 2025-11-12, fix not delivered. ZDI-only mitigation: restrict interaction with product. Not exploited per sources; no PoC found. Social not searched (low-profile). Nothing verified: ZDI is not the vendor and no vendor page exists.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-870/"]}],"documents":[{"id":131540,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-870/","title":"ZDI-26-870 Ashlar-Vellum Cobalt XE stack-based buffer overflow (0day)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}