A use-after-free vulnerability exists in Ashlar-Vellum Cobalt XE file parsing that allows remote attackers to execute arbitrary code. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The flaw arises from improper validation of object existence before operations, enabling code execution in the context of the current process.