A use-after-free vulnerability in Ashlar-Vellum Cobalt XE file parsing allows remote attackers to execute arbitrary code. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The flaw arises from improper validation of object existence before operations during XE file parsing.