Skip to main content

Nasm CVE-2026-6067

| EUVDEUVD-2026-21378 MEDIUM
Out-of-bounds Write (CWE-787)
2026-04-10 certcc GHSA-6h49-94j7-p577
RCE Buffer Overflow Denial Of Service Memory Corruption Nasm
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malicious ASM file with oversized directive
  2. Delivery
    Supply to NASM assembler
  3. Exploit
    Trigger bounds check bypass in obj_directive()
  4. Execution
    Overflow heap buffer
  5. Impact
    Corrupt memory or crash process

Vulnerability Assessment

Weakness
CWE
CWE-787
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Local user must assemble a malicious .asm file using NASM. No authentication required. Victim interaction required: user must execute NASM with attacker-controlled .asm file. Affects NASM versions with vulnerable obj_directive() function.
Impact

CVSS 7.5 reflects high availability impact from unauthenticated network exploitation. However, attack surface is constrained: requires user to assemble malicious .asm files via NASM. Moderate observed exploitation activity. Impact limited to developers/build systems using NASM, not end-user applications. Priority depends on NASM deployment scope in your environment.
Exploit ScenarioDerived

Attacker crafts malicious .asm file with oversized directive payloads triggering heap overflow in obj_directive(). Victim assembles file locally or via CI/CD pipeline, causing NASM crash (DoS) or potential code execution. Publicly available exploit code exists; no authentication required for file processing.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 10, 2026

Heap buffer overflow in Netwide Assembler (NASM) 3.02rc5 obj_directive() function enables arbitrary code execution and denial of service when processing maliciously crafted .asm files. Missing bounds validation allows attackers to corrupt heap memory through specially constructed assembly source files. Publicly available exploit code exists. Impacts NASM users assembling untrusted input files, particularly automated build systems and development environments processing external assembly code.

RemediationAI

No vendor-released patch identified at time of analysis. Upstream issue tracking active at https://github.com/netwide-assembler/nasm/issues/203 - monitor for official fix announcement. Immediate mitigations: (1) restrict NASM usage to trusted assembly source files only, (2) disable automated processing of external/user-submitted .asm files in build pipelines, (3) implement sandboxing for NASM execution contexts using containerization or VM isolation, (4) validate assembly file inputs through static analysis before assembly. Organizations using NASM 3.02rc5 in production should revert to stable release 3.01 pending security update. Subscribe to NASM project security advisories and apply patched version immediately upon release. Advisory reference: https://nvd.nist.gov/vuln/detail/CVE-2026-6067

Affected VersionsENISA

nasm nasm-3.02rc5

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Root cause: absent bounds checking in obj_directive() function during assembly file parsing. Heap overflow occurs when processing malformed directives in object file format handlers. CWE classification unavailable. Exploitation requires target to assemble attacker-controlled .asm file. CVSS vector indicates network-accessible attack surface (AV:N), though practical exploitation requires social engineering or supply chain positioning.

Know when Nasm gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.3 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Severity Changed
Apr 23, 2026 - 18:42 NVD
HIGH MEDIUM
CVSS changed
Apr 23, 2026 - 18:42 NVD
7.5 (HIGH) 5.5 (MEDIUM)
CVE Published
Apr 10, 2026 - 13:30 nvd
HIGH 7.5

DescriptionCVE.org

A heap buffer overflow vulnerability exists in the Netwide Assembler (NASM) due to a lack of bounds checking in the obj_directive() function. This vulnerability can be exploited by a user assembling a malicious .asm file, potentially leading to heap memory corruption, denial of service (crash), and arbitrary code execution.

Executive ViewAI

Why It Matters

Netwide Assembler (NASM) 3.02rc5 contains a heap buffer overflow vulnerability that allows arbitrary code execution when processing malicious assembly files, posing significant risk to development teams and automated build pipelines that handle external or untrusted source code. Organizations using NASM in CI/CD workflows or accepting assembly contributions face potential compromise of build infrastructure and deployed artifacts. No vendor patch is currently available, requiring immediate compensating controls.

Business Impact: High
Compensating Controls

Implement strict input validation: reject or manually review all .asm files from untrusted sources before assembly processing; isolate NASM-based build systems on segregated networks with no direct production connectivity; enforce run-time constraints using OS-level sandboxing (containers, VMs) for assembly compilation tasks; maintain audit logging of all assembly file inputs and processing activities; require cryptographic signatures on assembly source files from authorized developers only.

Threat Intelligence Overview

EPSS Score
0.1%
Top 82% exploitable
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
Poc
System Exposure· derived
Small
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Related Vulnerabilities in NASM Buffer Overflow and Memory Corruption

View all 3
CVE-2026-6069 HIGH
7.5
CVE-2026-6068 CRITICAL
9.6

More in Nasm

View all
CVE-2020-24978 CRITICAL POC
9.8 Sep 04

In NASM 2.15.04rc3, there is a double-free vulnerability in pp_tokline asm/preproc.c. Rated critical severity (CVSS 9.8)
CVE-2017-10686 HIGH POC
7.8 Jun 29

In Netwide Assembler (NASM) 2.14rc0, there are multiple heap use after free vulnerabilities in the tool nasm. Rated high
CVE-2023-31722 HIGH POC
7.8 May 17

There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891). Rated high severity (CVSS 7.8), this vu
CVE-2019-8343 HIGH POC
7.8 Feb 15

In Netwide Assembler (NASM) 2.14.02, there is a use-after-free in paste_tokens in asm/preproc.c. Rated high severity (CV
CVE-2018-19216 HIGH POC
7.8 Nov 12

Netwide Assembler (NASM) before 2.13.02 has a use-after-free in detoken at asm/preproc.c. Rated high severity (CVSS 7.8)
CVE-2018-19215 HIGH POC
7.8 Nov 12

Netwide Assembler (NASM) 2.14rc16 has a heap-based buffer over-read in expand_mmac_params in asm/preproc.c for the speci
CVE-2018-19214 HIGH POC
7.8 Nov 12

Netwide Assembler (NASM) 2.14rc15 has a heap-based buffer over-read in expand_mmac_params in asm/preproc.c for insuffici
CVE-2018-10254 HIGH POC
7.8 Apr 21

Netwide Assembler (NASM) 2.13 has a stack-based buffer over-read in the disasm function of the disasm/disasm.c file. Rat
CVE-2017-17818 HIGH POC
7.5 Dec 21

In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read that will cause a remote denial of service a
CVE-2017-17819 MEDIUM POC
5.5 Dec 21

In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in the function find_cc() in asm/preproc.c that

CVE-2017-17815 MEDIUM POC
5.5 Dec 21

In Netwide Assembler (NASM) 2.14rc0, there is an illegal address access in is_mmacro() in asm/preproc.c that will cause

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-6067 ADVISORY https://vuldb.com/vuln/356816 REF https://github.com/netwide-assembler/nasm/issues/203

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy