CVE-2026-19781: Ashlar-Vellum Cobalt heap buffer overflow in VS file parsing

CVE-2026-19781 · Severity: high · CVSS 7.8 · Published 2026-09-15

Ashlar-Vellum Cobalt is a design and visualization software used for engineering and technical drawings. A heap buffer overflow vulnerability in its VS file parser allows attackers to execute arbitrary code when a user opens a malicious file, potentially compromising the integrity of systems and enabling unauthorized access to sensitive design data or system credentials.

Quick answers

Is CVE-2026-19781 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-19781 being exploited in the wild.
How severe is CVE-2026-19781?
High severity, with a CVSS score of 7.8, published 15 September 2026.
Which products and versions are affected?
Ashlar-Vellum Cobalt before 12.6.1204.210.
Is there a fix for CVE-2026-19781?
A patch was published on 2026-08-24: Fixed in version 12.6.1204.210 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19781 attacked?
It is attacked with local access.
Am I affected by CVE-2026-19781?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow vulnerability exists in Ashlar-Vellum Cobalt's VS file parser due to insufficient validation of user-supplied data length before copying to a heap buffer. The attack vector is local (requires user interaction to open a malicious VS file), but remote delivery is possible via social engineering or malicious pages. An attacker can craft a specially formatted VS file that, when opened by a victim, triggers the overflow and achieves arbitrary code execution in the context of the Cobalt process. The vulnerability was patched in version 12.6.1204.210.

Affected products

  • Ashlar-Vellum Cobalt before 12.6.1204.210

Timeline

  • 2025-11-11: disclosed: Vulnerability reported to vendor
  • 2026-08-24: patched: Fixed in version 12.6.1204.210
  • 2026-08-24: advisory: Public advisory published (ZDI-26-587, CVE-2026-19781)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.