CVE-2026-19781: Ashlar-Vellum Cobalt RCE Vulnerability

CVE-2026-19781 Overview

CVE-2026-19781 is a heap-based buffer overflow [CWE-122] in Ashlar-Vellum Cobalt affecting the parsing of VS files. The flaw allows attackers to execute arbitrary code in the context of the current user process. Exploitation requires the target to open a malicious file or visit a malicious page. The Zero Day Initiative tracked this issue as ZDI-CAN-28173 and published advisory ZDI-26-587.

Critical Impact
Successful exploitation grants arbitrary code execution in the context of the current process on systems running vulnerable Ashlar-Vellum Cobalt installations.

Affected Products

Ashlar-Vellum Cobalt (VS file parser component)
Installations processing untrusted VS files
Workstations where users open Cobalt project files from external sources

Discovery Timeline

2026-09-15 - CVE-2026-19781 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-19781

Vulnerability Analysis

The vulnerability resides in the routine that parses VS files within Ashlar-Vellum Cobalt. The parser copies user-supplied data into a heap-allocated buffer without validating the length of that data. When the source data exceeds the destination allocation, the write overflows adjacent heap memory. An attacker who controls the file contents can corrupt heap metadata and control-flow structures. This gives the attacker a primitive to execute arbitrary code within the process handling the file.

Root Cause

The root cause is missing bounds validation prior to a heap buffer copy operation, classified under [CWE-122] Heap-based Buffer Overflow. The parser trusts a length or size value embedded in the attacker-controlled VS file. No sanity check compares that value against the destination buffer allocation before the copy proceeds.

Attack Vector

Exploitation is local and requires user interaction. A victim must open a crafted VS file or visit a page that delivers such a file to the vulnerable application. Delivery vectors include phishing emails with attached CAD project files, drive-by downloads, and shared network locations hosting weaponized designs. Code execution occurs at the privilege level of the user running Cobalt.

No public exploit code or proof-of-concept has been published at this time. Refer to the Zero Day Initiative Advisory ZDI-26-587 for additional technical context.

Detection Methods for CVE-2026-19781

Indicators of Compromise

Unexpected child processes spawned by the Cobalt application after opening a VS file
Crashes in the Cobalt process referencing heap corruption or access violations in the file parser
VS files arriving from untrusted email attachments, external file shares, or web downloads
Outbound network connections initiated by the Cobalt process shortly after file open

Detection Strategies

Monitor for anomalous process lineage where Cobalt spawns command shells, script interpreters, or LOLBins
Alert on Windows Error Reporting or crash dumps generated by the Cobalt executable indicating heap corruption
Inspect email gateways and web proxies for VS file attachments originating from external senders
Correlate file-open events for VS files with subsequent process injection or memory allocation anomalies

Monitoring Recommendations

Enable endpoint telemetry that captures process creation, image loads, and memory protection changes for the Cobalt process
Log file access events for .vs extensions in user document directories and shared drives
Track user-initiated file opens against threat intelligence feeds referencing ZDI-26-587
Review crash reports weekly to identify patterns consistent with exploitation attempts

How to Mitigate CVE-2026-19781

Immediate Actions Required

Restrict opening of VS files received from untrusted sources until a vendor patch is applied
Contact Ashlar-Vellum to confirm the availability of a fixed release addressing ZDI-CAN-28173
Apply application allowlisting to prevent unauthorized child processes from Cobalt
Train users on the risk of opening CAD project files from unsolicited emails or external websites

Patch Information

At the time of publication, no vendor advisory or patch URL is referenced in the NVD entry. Administrators should consult Ashlar-Vellum support channels and the Zero Day Initiative Advisory ZDI-26-587 for remediation guidance and update the software as soon as a fixed build is released.

Workarounds

Block .vs file attachments at email gateways when the sender is external
Isolate workstations running Cobalt on network segments with restricted outbound access
Run Cobalt under a low-privilege user account to limit the impact of exploitation
Use file reputation and sandboxing services to detonate VS files before user access

bash

# Example: block .vs attachments at an Exchange transport rule (PowerShell)
New-TransportRule -Name "Block-VS-Attachments" \
  -AttachmentExtensionMatchesWords "vs" \
  -FromScope NotInOrganization \
  -RejectMessageReasonText "VS attachments from external senders are blocked pending CVE-2026-19781 mitigation."