Use-After-Free Vulnerability in Ashlar-Vellum Cobalt XE File Parsing
CVE-2026-121742

7.8HIGH

Key Information:

Vendor

Ashlar-vellum

Status
Cobalt
Vendor
CVE Published:
12 November 2026

What is CVE-2026-121742?

A use-after-free vulnerability exists within the file parsing mechanisms of Ashlar-Vellum Cobalt XE, particularly when handling XE files. This flaw arises from the insufficient validation of object existence before performing subsequent operations. An attacker can exploit this weakness by enticing a user to visit a specially crafted webpage or to open a malicious file, potentially allowing the execution of arbitrary code within the context of the affected application. This highlights the importance of thorough input validation in software design and development.

Affected Version(s)

Cobalt 1204.209

References

https://www.zerodayinitiative.com/advisories/ZDI-26-874/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.