(0Day) Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability

The XE parser uses an object without confirming that it is still valid. An attacker can exploit this lifetime error to run code inside Cobalt when a user opens a crafted file or visits a malicious page.

Solution / Mitigation

ZDI published this issue as a zero-day on 4 November 2026. Its advisory does not identify a fixed version and recommends restricting interaction with the product. Consult the linked ZDI advisory for remediation updates.