CVE-2026-6068

EUVD-2026-21380
NASM contains a heap use after free vulnerability in response file (-@) processing where a dangling pointer to freed memory is stored in the global depend_file and later dereferenced, as the response-file buffer is freed before the pointer is used, allowing for data corruption or remote code execution.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.6 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 35.72%
Affected Products (NVD)
VendorProductVersion
nasmnetwide_assembler
3.02:rc5
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
nasm
bookworm
unimportant
bullseye
unimportant
forky
unimportant
sid
unimportant
trixie
unimportant
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
nasm
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
xenial
ignored
Common Weakness Enumeration
References
https://github.com/netwide-assembler/nasm/issues/222
https://sekai.team/blog/nasm-cve-disclosure/cve-2026-6068