This vulnerability in Ashlar-Vellum Cobalt (version 1204.204) arises from a heap-based buffer overflow in the VS file parsing component. The flaw is caused by insufficient validation of the length of user-supplied data before it is copied into a heap buffer, allowing an attacker to overflow the buffer. Successful exploitation requires user interaction and enables remote code execution in the context of the current process. The vulnerability is tracked as CVE-2026-19781 and was assigned a CVSS 3.0 base score of 7.8, indicating high severity.

An attacker who successfully exploits this vulnerability can execute arbitrary code remotely with the privileges of the affected process. This can lead to full compromise of the affected system, impacting confidentiality, integrity, and availability. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious webpage.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid opening untrusted VS files or visiting untrusted pages that could trigger the vulnerability.