Published advisory · ZDI-26-870
(0Day) Ashlar-Vellum Cobalt XE File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability
CVSS v3 base score
7.8High severity · as published by ZDI
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Vulnerability analysis
The XE parser copies file data into a stack buffer without checking that the data fits. Opening a crafted file or visiting a malicious page can result in attacker-controlled code running inside Cobalt.
Solution / Mitigation
ZDI published this issue as a zero-day on 4 November 2026. Its advisory does not identify a fixed version and recommends restricting interaction with the product. Consult the linked ZDI advisory for remediation updates.
Disclosure timeline
- Vulnerability reported to vendor
- ZDI notified the vendor of planned zero-day publication
- ZDI published the advisory as a zero-day
References