OW2 ASM EUVD-2026-101212

Exploitation requires an application that uses OW2 ASM (versions 3.0 up to but not including 9.11) to parse an attacker-controlled or otherwise untrusted Java class file through the code path that reaches Label.addSubroutineRetSuccessors() - i.e. processing of legacy JSR/RET subroutine bytecode. The crafted file must contain a single JSR associated with multiple RET instructions, which the pre-9.11 code fails to reject. Limiting factors: impact is availability-only (a ~2 GB allocation that crashes the JVM - no code execution or data disclosure); the CVSS vector is local (AV:L) with required processing of the malicious input (UI:P), so the attacker needs a means to deliver the class file into ASM's parsing pipeline; environments that never process untrusted bytecode are effectively not exposed. There is no authentication requirement expressed in the 4.0 vector (PR:N), but the practical precondition is a feature or workflow that accepts externally-sourced class files.

This is a medium-severity denial-of-service issue (vendor CVSS 4.0 base 6.8), and the available signals paint a consistent, non-urgent picture rather than a conflicting one. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) shows only availability impact (VA:H) with no confidentiality or integrity effect, confirming this is a JVM crash, not code execution or data exposure. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active or at-scale exploitation - status is 'no public exploit identified at time of analysis.' The limiting factor is the AV:L local vector plus UI:P (the vulnerable application must be made to parse an attacker-supplied class file), which sharply narrows real-world exposure: ASM itself is ubiquitous, but the exploitable path only exists where an application feeds untrusted/externally-sourced bytecode through ASM. Net: a real but low-to-medium priority for most environments, meaningfully higher for services that intentionally process untrusted class files (bytecode analyzers, class-upload features, plugin/agent loaders). Note the vector is AV:L despite the attack being 'supply a crafted file' - if your deployment accepts such files over the network, treat effective reachability as higher than the local vector implies and verify against the VulnCheck advisory.

An application built on OW2 ASM (e.g. a bytecode analyzer, instrumentation agent, or a service that accepts user-uploaded Java class files) is passed a crafted, invalid class file containing a single JSR with multiple RET instructions. ASM's Label.addSubroutineRetSuccessors() fails to enforce the single-RET-per-JSR rule and attempts a roughly 2 GB allocation, exhausting heap and crashing the JVM, taking down the service. No public exploit code was identified in the provided data, and the local attack vector with required processing (UI:P) means the attacker must get the malicious class into the application's parsing path.