{"id":"CVE-2026-121752","kind":"vulnerability","aliases":["CVE-2026-121752"],"related":[],"title":"Ashlar-Vellum Cobalt: crafted LI file lets attackers run code","description":"Ashlar-Vellum Cobalt LI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of LI files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28447.","summary":"Ashlar-Vellum Cobalt does not check the length of data read from LI files before copying it into a heap buffer. A remote attacker who gets a user to open a malicious file or visit a malicious page can run arbitrary code in the context of the current process.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Ashlar-Vellum Cobalt","fixed":[],"affected":"1204.207","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ashlar-vellum","cobalt","desktop","file-parsing","other","windows"],"not_affected_if":["no-untrusted-li-files"],"how_to_check":"Check the installed Ashlar-Vellum Cobalt version (Help > About). NVD (via ZDI) lists 1204.207 as affected; other builds are not stated by the sources.","fix":"No vendor fix published as of 2026-11-12; ZDI published as a 0-day advisory.","status":"open","published_at":"2026-11-12T03:17:10+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","triaged_at":"2026-11-12T03:47:26+00:00","updated_at":"2026-11-12T03:49:47+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-12T03:47:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Ashlar-Vellum Cobalt: crafted LI file lets attackers run code","impact":"high","summary":"Ashlar-Vellum Cobalt does not check the length of data read from LI files before copying it into a heap buffer. A remote attacker who gets a user to open a malicious file or visit a malicious page can run arbitrary code in the context of the current process.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ashlar-vellum","cobalt","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Arbitrary code runs in the current process context","analyst_note":"Find affected Cobalt versions, a vendor fix, and the ZDI advisory (ZDI-CAN-28447) for detail on the LI file trigger.","how_to_check":"- unknown","plain_action":"","product_name":"Ashlar-Vellum Cobalt","needs_analyst":true,"not_affected_if":["no-untrusted-li-files"],"who_is_affected":"Organizations running Ashlar-Vellum Cobalt with LI file parsing are exposed. Exploitation needs a user to open a malicious file or visit a malicious page, so systems that never open untrusted LI files are less exposed. The sources do not list affected versions.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4692,"output_tokens":516,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected Cobalt versions, a vendor fix, and the ZDI advisory (ZDI-CAN-28447) for detail on the LI file trigger.","search":"'-121752':14A,17A '-2026':13A,16A '28447':194C 'affect':108C 'allow':100C 'arbitrari':73B,105C 'ashlar':2A,19A,23B,33B,83C,112C 'ashlar-vellum':1A,18A,22B,32B,82C,111C 'attack':9A,56B,102C,175C 'base':91C,172C 'buffer':53B,92C,173C 'check':38B 'cobalt':4A,21A,25B,35B,85C,114C 'code':11A,74B,95C,106C,182C 'context':77B,185C 'copi':48B,166C 'craft':5A 'current':80B,188C 'cve':12A,15A 'data':42B,163C 'desktop':26B 'execut':96C,104C,181C 'exist':140C 'exploit':120C 'file':7A,28B,46B,65B,87C,136C,146C 'file-pars':27B 'flaw':139C 'get':58B 'heap':52B,90C,171C 'heap-bas':89C,170C 'instal':109C 'interact':116C 'issu':148C 'lack':152C 'length':40B,158C 'let':8A 'leverag':177C 'li':6A,45B,86C,145C 'malici':64B,69B,130C,135C 'must':127C 'open':62B,133C 'overflow':93C 'page':70B,131C 'pars':29B,88C,143C 'prior':164C 'process':81B,189C 'proper':154C 'read':43B 'remot':55B,94C,101C 'requir':118C 'result':149C 'run':10A,72B 'specif':138C 'suppli':162C 'target':126C 'user':60B,115C,161C 'user-suppli':160C 'valid':155C 'vellum':3A,20A,24B,34B,84C,113C 'visit':67B,128C 'vulner':97C,99C,122C,179C 'window':31B 'within':141C 'zdi':192C 'zdi-can':191C","nicknames":[],"mitigations":[],"who_affected":"Windows users of Ashlar-Vellum Cobalt who open LI files from untrusted sources. Exploitation needs a user to open a malicious file or visit a malicious page, and code runs as the current process. Teams that never open third-party Cobalt files can deprioritise it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["ashlarvellumcobalt","cobalt"],"ptokens":["ashlar","cobalt","vellum"],"labels":["ashlarvellum","cobalt","desktop","fileparsing","high","other","vendor","windows"],"campaign_type":null,"search_a":"'-121752':14A,17A '-2026':13A,16A 'ashlar':2A,19A 'ashlar-vellum':1A,18A 'attack':9A 'cobalt':4A,21A 'code':11A 'craft':5A 'cve':12A,15A 'file':7A 'let':8A 'li':6A 'run':10A 'vellum':3A,20A","search_b":"'arbitrari':73B 'ashlar':23B,33B 'ashlar-vellum':22B,32B 'attack':56B 'buffer':53B 'check':38B 'cobalt':25B,35B 'code':74B 'context':77B 'copi':48B 'current':80B 'data':42B 'desktop':26B 'file':28B,46B,65B 'file-pars':27B 'get':58B 'heap':52B 'length':40B 'li':45B 'malici':64B,69B 'open':62B 'page':70B 'pars':29B 'process':81B 'read':43B 'remot':55B 'run':72B 'user':60B 'vellum':24B,34B 'visit':67B 'window':31B","search_c":"'28447':194C 'affect':108C 'allow':100C 'arbitrari':105C 'ashlar':83C,112C 'ashlar-vellum':82C,111C 'attack':102C,175C 'base':91C,172C 'buffer':92C,173C 'cobalt':85C,114C 'code':95C,106C,182C 'context':185C 'copi':166C 'current':188C 'data':163C 'execut':96C,104C,181C 'exist':140C 'exploit':120C 'file':87C,136C,146C 'flaw':139C 'heap':90C,171C 'heap-bas':89C,170C 'instal':109C 'interact':116C 'issu':148C 'lack':152C 'length':158C 'leverag':177C 'li':86C,145C 'malici':130C,135C 'must':127C 'open':133C 'overflow':93C 'page':131C 'pars':88C,143C 'prior':164C 'process':189C 'proper':154C 'remot':94C,101C 'requir':118C 'result':149C 'specif':138C 'suppli':162C 'target':126C 'user':115C,161C 'user-suppli':160C 'valid':155C 'vellum':84C,113C 'visit':128C 'vulner':97C,99C,122C,179C 'within':141C 'zdi':192C 'zdi-can':191C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121752","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121752","severity":null,"published_at":"2026-11-12T03:17:10+00:00","modified_at":"2026-11-12T03:17:11+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","fetched_at":"2026-11-12T03:46:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121752:3683","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-871/","severity":null,"published_at":"2026-11-12T03:49:47+00:00","modified_at":"2026-11-12T03:49:47+00:00","first_seen_at":"2026-11-12T03:49:47+00:00","fetched_at":"2026-11-12T03:49:47+00:00","note":"ZDI-26-871 0-day (reported 2025-12-04, published 2026-11-04); no vendor fix or advisory found. NVD lists affected 1204.207. Not exploited per sources, no PoC seen.","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-871/"]}],"documents":[{"id":131538,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-871/","title":"ZDI-26-871 Ashlar-Vellum Cobalt LI File Parsing Heap-based Buffer Overflow","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}