OW2 ASM CVE-2026-110262

Exploitation requires that a target application or tool use the asm-commons AdviceAdapter to process class files that an attacker can influence, and that it accept attacker-supplied or untrusted bytecode (e.g. plugin loading, dependency/bytecode scanning, instrumentation of uploaded JARs, or CI pipelines handling external artifacts). The crafted class must contain a constructor with many forward jump targets to trigger the unbounded forwardJumpStackFrames stack copies. Limiting factors per the CVSS 4.0 vector: the attack vector is local (AV:L), not network-reachable, and requires passive user interaction (UI:P) - the victim process must ingest the malicious file; impact is confined to availability (VA:L, DoS), with no confidentiality or integrity effect, and the affected version range is ASM 3.1 before 9.11. Deployments that only ever process trusted, self-generated bytecode are effectively not exposed.

This is a genuine-but-modest-priority issue, not a high-severity emergency. The vendor-provided CVSS 4.0 vector (4.8, Medium) is internally consistent with the description: AV:L and UI:P indicate the attacker cannot reach the flaw over a network but must get a crafted class file processed locally (passively) by an application that uses asm-commons AdviceAdapter, and VC:N/VI:N/VA:L confirms the only impact is a bounded availability loss (memory exhaustion / DoS), with no confidentiality or integrity effect. There is no EPSS score, no CISA KEV listing, and no public POC referenced - so this is 'no public exploit identified at time of analysis.' All exploitation signals agree this is a low-to-moderate, availability-only risk rather than a high-CVSS-but-hidden-critical issue. The one signal that raises relative attention is reach: ASM is an extremely widely embedded Java bytecode library, so the flaw is present in a very large number of toolchains even though its impact per instance is limited. Note a caveat: CWE-770 (uncontrolled resource allocation) and the description support availability impact only, but the real risk depends entirely on whether a deployment feeds untrusted bytecode through AdviceAdapter - verify that against your own usage before prioritizing.

An attacker supplies a maliciously crafted Java class file to an application or build/analysis tool that uses asm-commons AdviceAdapter to transform or instrument bytecode (for example an uploaded plugin, a dependency scanner, or a CI step processing untrusted JARs). The crafted constructor contains many forward jump targets, triggering unbounded stack-frame copies in forwardJumpStackFrames and hundreds of megabytes of allocation, exhausting heap and causing the process to crash or hang. No public exploit code is referenced; exploitation is local with passive user interaction, so the attacker must get the file processed rather than reach the library remotely.