Nasm EUVD-2026-21380

The CVSS 3.1 base score of 6.5 reflects medium severity with low confidentiality impact (C:L) and low integrity impact (I:L) but no availability loss, characteristic of data corruption vulnerabilities. However, CISA's SSVC assessment significantly elevates real-world priority: exploitation is confirmed via a publicly available proof-of-concept, the attack is automatable (no user interaction required beyond supplying a malformed response file), and the technical impact is rated as partial rather than total. The combination of proof-of-concept availability, network-exploitability, and automatable attack path makes this a higher operational risk than the CVSS score alone suggests, particularly for development environments or build systems that process untrusted NASM response files. The confidentiality impact is limited (no authentication bypass or code execution), but the integrity impact and automatable nature warrant prioritization for patching, especially given NASM's use in cross-platform build chains.

An attacker crafts a malicious NASM response file (-@) containing carefully chosen arguments that trigger the dangling-pointer dereference in depend_file processing. When NASM assembles code using this response file, the freed buffer is accessed, potentially reading or corrupting adjacent heap memory. In an automated build environment, such a file could be injected into a build artifact or supplied as input to a CI/CD pipeline, causing unexpected behavior or data corruption in compiled binaries without requiring user interaction or privilege escalation. A proof-of-concept for this attack is publicly available, making exploitation straightforward for attackers with knowledge of build-system integration.