Ashlar-Vellum Cobalt CAD Vulnerabilities Risk System Integrity
Researchers recently discovered five zero-day vulnerabilities within the popular Ashlar-Vellum Cobalt computer-aided design software. Specifically, these critical flaws allow attackers to execute arbitrary code by manipulating complex drawing files. The Zero Day Initiative published formal advisories disclosing the unpatched defects to the global cybersecurity community. Consequently, engineers face severe risks if they process unverified industrial design files on compromised workstations. At the time of disclosure, the developer had not delivered validated security patches for these flaws.
Parsing Flaws in XE, LI, and AR Handlers
Exploitation requires user interaction rather than direct network penetration. In particular, adversaries must entice an unsuspecting operator to open a weaponized CAD drawing. Alternatively, attackers can steer victims toward malicious web portals that trigger local file handlers. Once launched, the malicious payload executes instructions under the security privileges of the active application.
Security researcher Rocco Calvi of TecSecurity originally identified all five memory corruption vulnerabilities. Three distinct defects compromise the software’s XE data handler. These flaws include a critical stack-based buffer overflow cataloged as CVE-2026-121744. Furthermore, two use-after-free conditions are tracked under CVE-2026-121753 and CVE-2026-121742. Meanwhile, developers traced two dynamic memory allocation errors in the LI and AR handlers to CVE-2026-121752 and CVE-2026-121743. In both instances, the software copies input streams into heap memory without enforcing strict buffer bounds.
Disclosure Timeline and Unresolved Patch Status
The coordinated disclosure effort spanned nearly an entire calendar year without resolution. Initially, researchers transmitted technical vulnerability reports to Ashlar-Vellum in November 2025. Subsequently, defensive coordinators issued repeated status inquiries throughout the winter and spring. In July, software representatives acknowledged that remediation builds for multiple memory defects remained unfinished. As documented in the Zero Day Initiative security advisory for Cobalt, coordinators published details following a formal disclosure warning.
Broader Lineage and Industrial Software Precedents
Historical precedent suggests that related CAD applications warrant immediate scrutiny. Previously, government security teams audited similar file parsing flaws across the broader product suite. For instance, the CISA industrial cybersecurity advisory on Ashlar-Vellum documented parser defects across Xenon, Argon, and Lithium tools. While these newly uncovered vulnerabilities officially target Cobalt, neighboring products share common foundational codebases.
Currently, the Zero Day Initiative assigns each vulnerability a high-severity CVSS score of 7.8. Fortunately, defensive analysts have observed no active in-the-wild exploitation campaigns targeting these defects. Nevertheless, engineering teams should restrict file ingestion workflows until certified vendor updates arrive. Ultimately, practicing strict file isolation provides the most reliable defense against weaponized design assets.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
