CVE-2026-6067

MEDIUM

NASM - Heap Buffer Overflow in obj_directive() Function

Title source: llm

Description

A heap buffer overflow vulnerability exists in the Netwide Assembler (NASM) due to a lack of bounds checking in the obj_directive() function. This vulnerability can be exploited by a user assembling a malicious .asm file, potentially leading to heap memory corruption, denial of service (crash), and arbitrary code execution.

References (1)

Core 1

Core References

https://github.com/netwide-assembler/nasm/issues/203

Scores

CVSS v3 5.5

EPSS 0.0035

EPSS Percentile 26.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-787

Status published

Products (2)

NASM/NASM nasm-3.02rc5

nasm/netwide_assembler 3.02 rc5

Published Apr 10, 2026

Tracked Since Apr 10, 2026