CVE-2026-121743: Ashlar-Vellum Cobalt heap-based buffer overflow in AR file parsing

CVE-2026-121743 · Severity: high · CVSS 7.8 · Published 2026-11-12

Ashlar-Vellum Cobalt is a design and drafting software used for creating technical drawings. A heap-based buffer overflow in its AR file parser allows an attacker to achieve remote code execution when a user opens a malicious AR file or visits a compromised webpage. An exploit could give an attacker complete control over the user's system to steal data, install malware, or launch further attacks.

Technologies: Ashlar-Vellum Cobalt. Vendors: Ashlar-Vellum.

Quick answers

Is CVE-2026-121743 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-121743 being exploited in the wild.
How severe is CVE-2026-121743?
High severity, with a CVSS score of 7.8, published 12 November 2026.
Which products and versions are affected?
Ashlar-Vellum Cobalt.
Is there a fix for CVE-2026-121743?
No fixed version is recorded yet. Restrict user interaction with the product until a patch is available; avoid opening AR files from untrusted sources and exercise caution when visiting webpages that may host malicious content. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-121743 attacked?
It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-121743?
Check whether you run Ashlar-Vellum Cobalt. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict user interaction with the product until a patch is available; avoid opening AR files from untrusted sources and exercise caution when visiting webpages that may host malicious content.

Technical details

The vulnerability is a heap-based buffer overflow caused by insufficient validation of user-supplied data length before copying to a heap buffer during AR file parsing. An attacker can craft a malicious AR file that triggers the overflow to execute arbitrary code in the context of the Cobalt process. User interaction (opening a file or visiting a malicious page) is required; no fix has been released as of the advisory publication date.

Affected products

  • Ashlar-Vellum Cobalt

Timeline

  • 2026-01-22: disclosed: Vulnerability reported to vendor by ZDI
  • 2026-01-28: other: Vendor acknowledged receipt
  • 2026-07-15: other: Vendor indicated fix was not yet completed
  • 2026-11-04: advisory: Coordinated public disclosure and 0-day advisory publication
  • 2026-11-12: other: CVE published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.