# CVE-2026-19781: Ashlar-Vellum Cobalt heap buffer overflow in VS file parsing

Source: https://junglewise.ai/threats/cve-2026-19781-ashlar-vellum-cobalt-heap-buffer-overflow-in-vs-file-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-19781 · Severity: high · CVSS 7.8 · Published 2026-09-15

Ashlar-Vellum Cobalt is a design and visualization software used for engineering and technical drawings. A heap buffer overflow vulnerability in its VS file parser allows attackers to execute arbitrary code when a user opens a malicious file, potentially compromising the integrity of systems and enabling unauthorized access to sensitive design data or system credentials.

## Quick answers

**Is CVE-2026-19781 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19781 being exploited in the wild.

**How severe is CVE-2026-19781?** High severity, with a CVSS score of 7.8, published 15 September 2026.

**Which products and versions are affected?** Ashlar-Vellum Cobalt before 12.6.1204.210.

**Is there a fix for CVE-2026-19781?** A patch was published on 2026-08-24: Fixed in version 12.6.1204.210 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19781 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-19781?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow vulnerability exists in Ashlar-Vellum Cobalt's VS file parser due to insufficient validation of user-supplied data length before copying to a heap buffer. The attack vector is local (requires user interaction to open a malicious VS file), but remote delivery is possible via social engineering or malicious pages. An attacker can craft a specially formatted VS file that, when opened by a victim, triggers the overflow and achieves arbitrary code execution in the context of the Cobalt process. The vulnerability was patched in version 12.6.1204.210.

## Affected products

- Ashlar-Vellum Cobalt before 12.6.1204.210

## Timeline

- 2025-11-11: disclosed: Vulnerability reported to vendor
- 2026-08-24: patched: Fixed in version 12.6.1204.210
- 2026-08-24: advisory: Public advisory published (ZDI-26-587, CVE-2026-19781)

## References

- [https://www.zerodayinitiative.com/advisories/ZDI-26-587/](https://www.zerodayinitiative.com/advisories/ZDI-26-587/)