CVE-2026-19781

A use-after-free vulnerability in Ashlar-Vellum Cobalt during CO file parsing allows remote attackers to execute arbitrary code. User interaction is required — the victim must visit a malicious page or open a malicious file. The flaw results from the lack of validating an object's existence before performing operations on it.

A heap-based buffer overflow vulnerability in Ashlar-Vellum Cobalt during CO file parsing allows remote attackers to execute arbitrary code. User interaction is required — the victim must visit a malicious page or open a malicious file. The flaw results from the lack of proper validation of the length of user-supplied data before copying it to a heap-based buffer.

Vulnerability in Ashlar-Vellum Cobalt XE while parsing XE files allows remote code execution. Lack of validation can lead to integer overflow before buffer allocation. User interaction is required, such as visiting a malicious page or opening a file.

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing XE files. It results from lack of validation of user-supplied data, leading to an out-of-bounds read past the end of an allocated data structure. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing XE files. It results from lack of validation of user-supplied data, leading to a type confusion condition. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing XE files. It results from lack of validation of user-supplied data, leading to an out-of-bounds read past the end of an allocated data structure. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing CO files. It results from lack of validation of user-supplied data, leading to an out-of-bounds read past the end of an allocated data structure. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing CO files. It results from lack of validation of user-supplied data, leading to a type confusion condition. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing CO files. It results from lack of validation of user-supplied data, leading to a memory corruption condition. Requires user interaction (visiting a malicious page or opening a malicious file).

Remote code execution vulnerability in Ashlar-Vellum Cobalt when parsing LI files. It results from lack of validation of user-supplied data, leading to a type confusion condition. Requires user interaction (visiting a malicious page or opening a malicious file).