---
id: "CVE-2026-121753"
page: "https://infrastack.ai/live/CVE-2026-121753"
kind: "vulnerability"
aliases: ["CVE-2026-121753"]
title: "Ashlar-Vellum Cobalt: crafted XE file lets attacker run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Cobalt", "fixed": [], "affected": "all versions (no range published)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ashlar-vellum", "cad", "cobalt", "desktop", "no-fix", "other", "use-after-free", "user-interaction"]
not_affected_if: ["unknown"]
published_at: "2026-11-12T03:17:11+00:00"
first_seen_at: "2026-11-12T03:46:13+00:00"
updated_at: "2026-11-12T03:48:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121753", "first_seen_at": "2026-11-12T03:46:13+00:00"}, {"source": "analyst", "url": "https://www.zerodayinitiative.com/advisories/ZDI-26-872/", "first_seen_at": "2026-11-12T03:48:43+00:00", "cites": ["https://www.zerodayinitiative.com/advisories/ZDI-26-872/"]}]
exploit_sources: []
---

# Ashlar-Vellum Cobalt: crafted XE file lets attacker run code

Link for people: https://infrastack.ai/live/CVE-2026-121753 (this .md is for agents)

Ashlar-Vellum Cobalt mishandles an object reference while parsing XE files, a use-after-free flaw. An attacker who gets a user to open a malicious file or visit a malicious page can run code in the context of the Cobalt process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Cobalt affected all versions (no range published) fixed no fixed version listed

## How to check

Check whether Ashlar-Vellum Cobalt is installed on any workstation. ZDI lists no affected version range, so treat every installed version as affected until the vendor publishes a fix.

## Fix

No vendor fix available as of ZDI-26-872 (2026-11-04). The vendor said on 2026-07-15 that the fix was not completed.

## Timeline

- 2026-11-12T03:46:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121753
- 2026-11-12T03:48:43+00:00 analyst https://www.zerodayinitiative.com/advisories/ZDI-26-872/ — ZDI-26-872 (0-day, published 2026-11-04): vendor had not completed a fix as of 2026-07-15; ZDI's only mitigation is to restrict interaction with the product. No affected version range given. Siblings ZDI-26-873/874 are separate Cobalt bugs (874 is also an XE UAF).

## Documents

- [advisory] ZDI-26-872 Ashlar-Vellum Cobalt XE File Parsing Use-After-Free RCE (0-day) https://www.zerodayinitiative.com/advisories/ZDI-26-872/

## From the sources

Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of XE files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28587.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_