OW2 ASM CVE-2026-112046

Exploitation requires a tool using the vulnerable OW2 ASM 9.11 (before 9.11.1) to parse and TRANSFORM an attacker-supplied class via ClassReader.accept(), where the rewritten method body grows beyond 65535 bytes, causing 16-bit forward-reference offsets to truncate in Label.resolve(). The specific prerequisite is a code-growing transformation path (instrumentation/rewriting) - not merely reading an unmodified class. Limiting factors: the attack vector is local (AV:L), a victim must actively run the vulnerable build tool, instrumenter, agent, or analyzer against the malicious input (UI passive), and only availability of that single process is affected - there is no code execution or data disclosure.

This is a denial-of-service issue in the OW2 ASM bytecode library (CWE-835, infinite loop in Label.resolve()). The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) and base score 6.8 (Medium) are internally consistent and align well with the description: a local attack vector, no privileges, passive user interaction (a victim must run a tool that parses the malicious class), and impact limited to availability (no confidentiality or integrity impact). There is no CISA KEV listing and no POC flag in the input, so exploitation status is 'no public exploit identified at time of analysis' - there is no EPSS value provided either, so widespread-exploitation probability cannot be quantified. The realistic risk is moderate and bounded: this hangs a single process (a build, an instrumentation agent, or an analyzer) rather than granting code execution or data access. It is a genuine supply-chain/tooling hazard because ASM is embedded in a huge number of Java build and analysis pipelines, but it is NOT a 'drop everything' critical issue - the local vector and required user interaction (feeding an attacker-crafted class into a vulnerable tool) limit mass exploitation. Note the trigger is conditional: it only manifests when ASM rewrites a method such that the transformed code grows past 65535 bytes, which depends on the transformation being performed, not merely on parsing any class.

An attacker publishes a malicious JAR/class (e.g., to a public artifact repository or as a dependency/plugin) crafted so that when an ASM 9.11-based tool transforms it, the rewritten method body grows past 64 KB. When a CI build, instrumentation agent, or static analyzer runs ClassReader.accept() over that class, Label.resolve() enters an infinite loop and the process hangs, stalling the pipeline. No public exploit code is identified at time of analysis, and the local attack vector plus required processing (UI:P) mean the victim must actually run the vulnerable tool against the crafted input.