{"id":"CVE-2026-121753","kind":"vulnerability","aliases":["CVE-2026-121753"],"related":[],"title":"Ashlar-Vellum Cobalt: crafted XE file lets attacker run code","description":"Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of XE files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28587.","summary":"Ashlar-Vellum Cobalt mishandles an object reference while parsing XE files, a use-after-free flaw. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the context of the Cobalt process.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Cobalt","fixed":[],"affected":"all versions (no range published)","ecosystem":"vendor"}],"ecosystems":[],"tags":["ashlar-vellum","cad","cobalt","desktop","no-fix","other","use-after-free","user-interaction"],"not_affected_if":["unknown"],"how_to_check":"Check whether Ashlar-Vellum Cobalt is installed on any workstation. ZDI lists no affected version range, so treat every installed version as affected until the vendor publishes a fix.","fix":"No vendor fix available as of ZDI-26-872 (2026-11-04). The vendor said on 2026-07-15 that the fix was not completed.","status":"open","published_at":"2026-11-12T03:17:11+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","triaged_at":"2026-11-12T03:47:25+00:00","updated_at":"2026-11-12T03:48:43+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-12T03:47:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Ashlar-Vellum Cobalt: crafted XE file lets attacker run code","impact":"high","summary":"Ashlar-Vellum Cobalt mishandles an object reference while parsing XE files, a use-after-free flaw. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the context of the Cobalt process.","audience":"businesses","category":"other","nicknames":[],"who_cares":["ashlar-vellum","cobalt","cad"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code in the Cobalt process on the user's machine.","analyst_note":"Find affected Cobalt versions and the vendor fix in the ZDI advisory (ZDI-CAN-28587) or NVD entry for CVE-2026-121753.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations that run Ashlar-Vellum Cobalt and open XE files from untrusted sources are exposed. The sources do not name affected versions or say which configurations are vulnerable.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4669,"output_tokens":460,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected Cobalt versions and the vendor fix in the ZDI advisory (ZDI-CAN-28587) or NVD entry for CVE-2026-121753.","search":"'-121753':14A,17A '-2026':13A,16A '28587':184C 'affect':105C 'allow':97C 'arbitrari':102C 'ashlar':2A,20B,37B,81C,109C 'ashlar-vellum':1A,19B,36B,80C,108C 'attack':9A,55B,99C,165C 'cad':22B 'cobalt':4A,18A,23B,39B,78B,83C,111C 'code':11A,72B,92C,103C,172C 'context':75B,175C 'craft':5A 'current':178C 'cve':12A,15A 'desktop':24B 'execut':93C,101C,171C 'exist':137C,153C 'exploit':117C 'file':7A,47B,64B,85C,133C,143C 'fix':27B 'flaw':53B,136C 'free':32B,52B,90C 'get':57B 'instal':106C 'interact':35B,113C 'issu':145C 'lack':149C 'let':8A 'leverag':167C 'malici':63B,68B,127C,132C 'mishandl':40B 'must':124C 'no-fix':25B 'object':42B,156C,163C 'open':61B,130C 'oper':160C 'page':69B,128C 'pars':45B,86C,140C 'perform':159C 'prior':157C 'process':79B,179C 'refer':43B 'remot':91C,98C 'requir':115C 'result':146C 'run':10A,71B 'specif':135C 'target':123C 'use':30B,50B,88C 'use-after-fre':29B,49B,87C 'user':34B,59B,112C 'user-interact':33B 'valid':151C 'vellum':3A,21B,38B,82C,110C 'visit':66B,125C 'vulner':94C,96C,119C,169C 'within':138C 'xe':6A,46B,84C,142C 'zdi':182C 'zdi-can':181C","nicknames":[],"mitigations":[],"who_affected":"Anyone who runs Ashlar-Vellum Cobalt (CAD software) and opens XE files from outside sources. Exploitation needs the user to open a malicious file or visit a malicious page. Teams that do not use Cobalt can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-12T03:48:43Z","by":"analyst","doc":"https://www.zerodayinitiative.com/advisories/ZDI-26-872/","run_id":3682}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["cobalt"],"ptokens":["cobalt"],"labels":["ashlarvellum","cad","cobalt","desktop","high","nofix","other","useafterfree","userinteraction"],"campaign_type":null,"search_a":"'-121753':14A,17A '-2026':13A,16A 'ashlar':2A 'ashlar-vellum':1A 'attack':9A 'cobalt':4A,18A 'code':11A 'craft':5A 'cve':12A,15A 'file':7A 'let':8A 'run':10A 'vellum':3A 'xe':6A","search_b":"'ashlar':20B,37B 'ashlar-vellum':19B,36B 'attack':55B 'cad':22B 'cobalt':23B,39B,78B 'code':72B 'context':75B 'desktop':24B 'file':47B,64B 'fix':27B 'flaw':53B 'free':32B,52B 'get':57B 'interact':35B 'malici':63B,68B 'mishandl':40B 'no-fix':25B 'object':42B 'open':61B 'page':69B 'pars':45B 'process':79B 'refer':43B 'run':71B 'use':30B,50B 'use-after-fre':29B,49B 'user':34B,59B 'user-interact':33B 'vellum':21B,38B 'visit':66B 'xe':46B","search_c":"'28587':184C 'affect':105C 'allow':97C 'arbitrari':102C 'ashlar':81C,109C 'ashlar-vellum':80C,108C 'attack':99C,165C 'cobalt':83C,111C 'code':92C,103C,172C 'context':175C 'current':178C 'execut':93C,101C,171C 'exist':137C,153C 'exploit':117C 'file':85C,133C,143C 'flaw':136C 'free':90C 'instal':106C 'interact':113C 'issu':145C 'lack':149C 'leverag':167C 'malici':127C,132C 'must':124C 'object':156C,163C 'open':130C 'oper':160C 'page':128C 'pars':86C,140C 'perform':159C 'prior':157C 'process':179C 'remot':91C,98C 'requir':115C 'result':146C 'specif':135C 'target':123C 'use':88C 'use-after-fre':87C 'user':112C 'valid':151C 'vellum':82C,110C 'visit':125C 'vulner':94C,96C,119C,169C 'within':138C 'xe':84C,142C 'zdi':182C 'zdi-can':181C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T03:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121753","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121753","severity":null,"published_at":"2026-11-12T03:17:11+00:00","modified_at":"2026-11-12T03:17:11+00:00","first_seen_at":"2026-11-12T03:46:13+00:00","fetched_at":"2026-11-12T03:46:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121753:3682","url":"https://www.zerodayinitiative.com/advisories/ZDI-26-872/","severity":null,"published_at":"2026-11-12T03:48:43+00:00","modified_at":"2026-11-12T03:48:43+00:00","first_seen_at":"2026-11-12T03:48:43+00:00","fetched_at":"2026-11-12T03:48:43+00:00","note":"ZDI-26-872 (0-day, published 2026-11-04): vendor had not completed a fix as of 2026-07-15; ZDI's only mitigation is to restrict interaction with the product. No affected version range given. Siblings ZDI-26-873/874 are separate Cobalt bugs (874 is also an XE UAF).","cites":["https://www.zerodayinitiative.com/advisories/ZDI-26-872/"]}],"documents":[{"id":131535,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-872/","title":"ZDI-26-872 Ashlar-Vellum Cobalt XE File Parsing Use-After-Free RCE (0-day)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}