Quick answers
- Is CVE-2026-121742 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-121742 being exploited in the wild.
- How severe is CVE-2026-121742?
- High severity, with a CVSS score of 7.8, published 12 November 2026.
- Which products and versions are affected?
- Ashlar-Vellum Cobalt.
- Is there a fix for CVE-2026-121742?
- No fixed version is recorded yet. Restrict user interaction with Cobalt until a patch becomes available; avoid opening untrusted XE files or visiting untrusted webpages that may reference the product. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-121742 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-121742?
- Check whether you run Ashlar-Vellum Cobalt. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Restrict user interaction with Cobalt until a patch becomes available; avoid opening untrusted XE files or visiting untrusted webpages that may reference the product.
Technical details
A use-after-free vulnerability exists in Ashlar-Vellum Cobalt's XE file parser where objects are accessed without first validating they exist. The vulnerability requires user interaction (opening a malicious file or visiting a malicious webpage) and results in code execution in the context of the current process. No patch is known to exist as of the advisory publication date.
Affected products
- Ashlar-Vellum Cobalt
Timeline
- 2026-02-06: disclosed: Vulnerability reported to vendor
- 2026-11-04: advisory: Coordinated public release of advisory