OW2 ASM EUVD-2026-101213

The target application must use OW2 ASM (3.0 up to but not including 9.11) to read and transform an attacker-controlled or untrusted Java class file through ClassWriter, specifically hitting the toByteArray()/replaceAsmInstructions() path; the malicious input is a class with a large method containing many long forward jumps that forces deep recursion. Limiting factors: the vector is Local (AV:L) and requires passive victim interaction (UI:P) in the form of the application processing the crafted class, impact is denial of service only (availability), and deployments that only transform trusted, first-party bytecode are not realistically exposed. Exploitation is unauthenticated (PR:N) but constrained by the need to deliver the crafted class into an ASM transformation flow.

This is a moderate-severity, low-urgency issue rather than a top priority. The vendor-assigned CVSS 4.0 vector (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) scores 6.8 and limits impact to availability only (VA:H; VC/VI:N) - there is no confidentiality or integrity loss and no scope change to subsequent systems. The attack vector is Local (AV:L) with passive user interaction (UI:P), meaning exploitation depends on an application being made to transform an attacker-supplied class file rather than on direct remote reachability. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so by the precision rules this is 'no public exploit identified at time of analysis'; the absence of a KEV/EPSS signal is consistent with a DoS-only recursion bug that is unattractive to mass exploitation. The main caveat is a vector/impact nuance: the flaw is a StackOverflowError (crash/DoS) in a library, so real-world severity hinges entirely on whether the embedding application processes untrusted bytecode - in most server deployments ASM transforms trusted application classes, which lowers practical risk well below what the raw 6.8 suggests. Reported by VulnCheck with a vendor patch available.

A Java application or tooling pipeline that uses OW2 ASM to read and transform externally supplied class files (e.g., a plugin loader, bytecode-instrumentation agent, or class-analysis service) is fed a crafted class containing a single large method with many long forward jumps. When ClassWriter.toByteArray()/replaceAsmInstructions() processes it, unbounded recursion exhausts the thread stack and throws a StackOverflowError, crashing the transformation and causing denial of service. No public exploit code is identified in the provided data, and exploitation requires the victim process to actually transform the malicious class (UI:P, AV:L).