---
id: "CVE-2026-121744"
page: "https://infrastack.ai/live/CVE-2026-121744"
kind: "vulnerability"
aliases: ["CVE-2026-121744"]
title: "Ashlar-Vellum Cobalt: crafted XE file can run code, no fix available"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Ashlar-Vellum Cobalt", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ashlar-vellum", "cad", "cobalt", "file-parsing", "no-fix", "other", "windows"]
not_affected_if: ["no-untrusted-xe-files", "no-xe-files-opened"]
published_at: "2026-11-12T03:17:10+00:00"
first_seen_at: "2026-11-12T03:46:13+00:00"
updated_at: "2026-11-12T03:49:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121744", "first_seen_at": "2026-11-12T03:46:13+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-870/", "first_seen_at": "2026-11-12T03:49:54+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-870/"]}]
exploit_sources: []
---

# Ashlar-Vellum Cobalt: crafted XE file can run code, no fix available

Link for people: https://infrastack.ai/live/CVE-2026-121744 (this .md is for agents)

ZDI published a 0-day: Cobalt copies data from XE files into a fixed stack buffer without checking its length (stack-based buffer overflow). A user who opens a crafted XE file, or visits a malicious page that leads to one, can let the attacker run code in the context of the Cobalt process. ZDI says the vendor has not released a fix; its only mitigation is to restrict interaction with the product.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Ashlar-Vellum Cobalt affected range not listed fixed no fixed version listed

## How to check

Check whether Ashlar-Vellum Cobalt is installed and which build. ZDI names no affected or fixed version, so treat installed builds as possibly affected until the vendor says otherwise. Check whether anyone opens .xe files from email, downloads or shared drives. Also check if you run Xenon or Argon (sibling Ashlar-Vellum products); no source says they are affected.

## Fix

No vendor fix as of ZDI-26-870 (2026-11-04). No Ashlar-Vellum advisory found.

## Timeline

- 2026-11-12T03:46:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121744
- 2026-11-12T03:49:54+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-870/ — ZDI-26-870 (0day, published 2026-11-04) read: no vendor fix, no affected version range given; vendor acknowledged 2025-11-12, fix not delivered. ZDI-only mitigation: restrict interaction with product. Not exploited per sources; no PoC found. Social not searched (low-profile). Nothing verified: ZDI is not the vendor and no vendor page exists.

## Documents

- [advisory] ZDI-26-870 Ashlar-Vellum Cobalt XE stack-based buffer overflow (0day) https://www.zerodayinitiative.com/advisories/ZDI-26-870/

## From the sources

Ashlar-Vellum Cobalt XE File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XE files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28172.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_