OW2 ASM CVE-2026-110260

Exploitation requires that the target application process an attacker-supplied class file through OW2 ASM (3.0 up to but not including 9.11) with the ClassWriter COMPUTE_MAXS or COMPUTE_FRAMES option enabled; the malicious class must contain thousands of overlapping exception handlers to trigger the quadratic Edge allocation in MethodWriter.computeMaxStackAndLocal()/computeAllFrames(). Limiting factors: the application must accept and analyze untrusted/attacker-controlled bytecode (UI:P - the app must load and process the crafted file), and must use the COMPUTE_MAXS/COMPUTE_FRAMES frame-computation modes; applications that only handle trusted class files or that do not enable these compute flags are not exposed. Authentication is not required (PR:N), and the vendor models the attack vector as Local (AV:L) rather than network-reachable.

Signals point to a genuine but bounded availability risk rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, VA:H, confidentiality and integrity N) scores 6.8 (Medium) and describes a pure denial-of-service: no data disclosure or modification, only a JVM crash via OutOfMemoryError. CWE-407 (inefficient algorithmic complexity / quadratic blow-up) is consistent with the description. The attack is unauthenticated (PR:N) and low-complexity (AC:L), but exploitation is gated on passive user interaction (UI:P) - the target application must actually parse the attacker's crafted class file through ASM with COMPUTE_MAXS or COMPUTE_FRAMES enabled, and the vendor models the vector as Local (AV:L) rather than Network. No EPSS score was provided, so exploitation probability cannot be quantified. The issue is NOT in CISA KEV, so it is not confirmed as actively exploited; and although VulnCheck published an advisory, the input does not flag public exploit code, so no POC should be assumed. Net: treat as a Medium-severity, availability-only DoS that matters most for services that compile, transform, or load untrusted bytecode with ASM's compute flags - not a drop-everything critical. One tension to verify: the CVSS vector is Local (AV:L) while real deployments (e.g. upload-and-process pipelines) could make the crafted class remotely reachable, which would raise effective exposure - verify the delivery path in your own environment.

An application uses OW2 ASM with COMPUTE_MAXS or COMPUTE_FRAMES to analyze or rewrite bytecode it accepts from users (for example a plugin loader, bytecode-processing service, or build tool). An attacker submits a crafted .class file containing thousands of overlapping exception handlers; when ASM's MethodWriter.computeMaxStackAndLocal()/computeAllFrames() builds its control-flow Edge graph, allocations grow quadratically and the JVM throws OutOfMemoryError, crashing the process. No public exploit code is identified in the provided data, though VulnCheck has published a technical advisory.