Published advisory · ZDI-26-874
(0Day) Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability
CVSS v3 base score
7.8High severity · as published by ZDI
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Vulnerability analysis
The XE parser operates on an object without verifying its validity. This separate use-after-free issue can allow code execution inside Cobalt after a user opens a crafted file or visits a malicious page.
Solution / Mitigation
ZDI published this issue as a zero-day on 4 November 2026. Its advisory does not identify a fixed version and recommends restricting interaction with the product. Consult the linked ZDI advisory for remediation updates.
Disclosure timeline
- Vulnerability reported to vendor
- ZDI notified the vendor of planned zero-day publication
- ZDI published the advisory as a zero-day
References