CVE-2026-6067: Buffer Overflow

Published Apr 10, 2026

Updated

A heap buffer overflow vulnerability exists in the Netwide Assembler (NASM) due to a lack of bounds checking in the objdirective() function. This vulnerability can be exploited by a user assembling a malicious .asm file, potentially leading to heap memory corruption, denial of service (crash), and arbitrary code execution.

Affected Software

2 affected components

Netwide Assembler NASM

nasm Netwide Assembler=3.02-rc5

Event History

Apr 10, 2026

CVE Published

via MITRE·01:30 PM

Data Sourced

via MITRE·01:30 PM

DescriptionWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeaknessAffected Software

Dec 16, 58262

Event

via FIRST·07:14 AM

Frequently Asked Questions

What is the severity of CVE-2026-6067?

CVE-2026-6067 has been classified as a high severity vulnerability due to its potential to cause heap memory corruption.

How do I fix CVE-2026-6067?

To fix CVE-2026-6067, update to the latest version of the Netwide Assembler that addresses this vulnerability.

Who is affected by CVE-2026-6067?

CVE-2026-6067 affects users of the Netwide Assembler, particularly those using version 3.02-rc5.

What type of vulnerability is CVE-2026-6067?

CVE-2026-6067 is a heap buffer overflow vulnerability caused by insufficient bounds checking in the obj_directive() function.

What could be the consequences of exploiting CVE-2026-6067?

Exploiting CVE-2026-6067 could lead to heap memory corruption and potentially result in a denial of service.