CVE-2026-6068: Use After Free

Published Apr 10, 2026

Updated

NASM contains a heap use after free vulnerability in response file (-@) processing where a dangling pointer to freed memory is stored in the global dependfile and later dereferenced, as the response-file buffer is freed before the pointer is used, allowing for data corruption or remote code execution.

Affected Software

2 affected components

nasm NASM

nasm Netwide Assembler=3.02-rc5

Event History

Apr 10, 2026

CVE Published

via MITRE·01:30 PM

Data Sourced

via MITRE·01:30 PM

DescriptionWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeaknessAffected Software

Aug 26, 58370

Event

via NVD·01:34 PM

Frequently Asked Questions

What is the severity of CVE-2026-6068?

CVE-2026-6068 is categorized as a high severity vulnerability due to the potential for data corruption and exploitation.

How do I fix CVE-2026-6068?

To fix CVE-2026-6068, update to the latest version of NASM that addresses this vulnerability.

What type of vulnerability is CVE-2026-6068?

CVE-2026-6068 is a heap use after free vulnerability found in the response file processing of NASM.

What software versions are affected by CVE-2026-6068?

CVE-2026-6068 affects NASM version 3.02-rc5.

Can CVE-2026-6068 lead to remote code execution?

CVE-2026-6068 can potentially lead to data corruption but does not inherently lead to remote code execution.