NASM contains a heap use after free vulnerability in response file (-@) processing where a dangling pointer to freed memory is stored in the global depend_file and later dereferenced, as the response-file buffer is freed before the pointer is used, allowing for data corruption or remote code execution.
References
| Link | Resource |
|---|---|
| https://github.com/netwide-assembler/nasm/issues/222 | Exploit Issue Tracking |
| https://sekai.team/blog/nasm-cve-disclosure/cve-2026-6068 | Exploit Third Party Advisory |
Configurations
History
26 May 2026, 20:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://sekai.team/blog/nasm-cve-disclosure/cve-2026-6068 - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.6 |
20 May 2026, 14:17
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) NASM contains a heap use after free vulnerability in response file (-@) processing where a dangling pointer to freed memory is stored in the global depend_file and later dereferenced, as the response-file buffer is freed before the pointer is used, allowing for data corruption or remote code execution. |
19 May 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
16 Apr 2026, 19:48
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-416 | |
| References | () https://github.com/netwide-assembler/nasm/issues/222 - Exploit, Issue Tracking | |
| CPE | cpe:2.3:a:nasm:netwide_assembler:3.02:rc5:*:*:*:*:*:* | |
| First Time |
Nasm netwide Assembler
Nasm |
10 Apr 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
10 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-10 14:16
Updated : 2026-06-17 11:00
NVD link : CVE-2026-6068
Mitre link : CVE-2026-6068
CVE.ORG link : CVE-2026-6068
JSON object : View
Products Affected
nasm
- netwide_assembler
CWE
CWE-416
Use After Free