Nasm CVE-2026-6068

NASM (Netwide Assembler) is an open-source x86 assembler that supports response files (invoked via the -@ flag) to read command-line arguments from a file. The vulnerability is rooted in improper memory management during response-file processing: a pointer to the response-file buffer is assigned to the global depend_file variable, but the buffer is deallocated before the pointer is subsequently dereferenced. This is a classic heap use-after-free flaw (CWE-416 category), where freed memory is accessed after deallocation, potentially allowing an attacker to read adjacent heap data or corrupt heap metadata. The affected product spans all versions of NASM, with confirmed vulnerable releases including 3.02rc5. The network attack vector (AV:N) and absence of privilege or user interaction requirements (PR:N, UI:N) mean that a malicious response file can be supplied remotely to trigger the flaw.