Published advisory · ZDI-26-871
(0Day) Ashlar-Vellum Cobalt LI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability
CVSS v3 base score
7.8High severity · as published by ZDI
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Vulnerability analysis
The LI parser fails to check input length before copying data into a heap buffer. A crafted file or malicious page can trigger memory corruption and code execution inside Cobalt.
Solution / Mitigation
ZDI published this issue as a zero-day on 4 November 2026. Its advisory does not identify a fixed version and recommends restricting interaction with the product. Consult the linked ZDI advisory for remediation updates.
Disclosure timeline
- Vulnerability reported to vendor
- ZDI notified the vendor of planned zero-day publication
- ZDI published the advisory as a zero-day
References