CVE-2026-6067
Published: 10 April 2026
Summary
CVE-2026-6067 is a medium-severity Out-of-bounds Write (CWE-787) vulnerability in Nasm Netwide Assembler. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 4.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-6067 is a heap buffer overflow vulnerability in the Netwide Assembler (NASM), caused by a lack of bounds checking in the obj_directive() function. It affects NASM when processing assembly files and is classified under CWE-787 (Out-of-bounds Write). The vulnerability was published on 2026-04-10.
A local attacker with no privileges can exploit this issue by tricking a user into assembling a malicious .asm file, which requires user interaction but is of low attack complexity. Exploitation can lead to heap memory corruption, denial of service through application crash, or arbitrary code execution. The CVSS v3.1 base score is 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), indicating medium severity primarily due to high availability impact.
Mitigation details and further discussion are available in the GitHub issue at https://github.com/netwide-assembler/nasm/issues/203.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21378
Vulnerability details
A heap buffer overflow vulnerability exists in the Netwide Assembler (NASM) due to a lack of bounds checking in the obj_directive() function. This vulnerability can be exploited by a user assembling a malicious .asm file, potentially leading to heap memory…
more
corruption, denial of service (crash), and arbitrary code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in NASM enables arbitrary code execution via malicious .asm file processed by user, directly mapping to client-side exploitation and malicious file execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation requires timely patching of the heap buffer overflow in NASM's obj_directive() function to eliminate the vulnerability.
Memory protection mechanisms such as heap isolation, randomization, and canaries prevent exploitation of heap buffer overflows leading to corruption or code execution.
Information input validation enforces bounds checking on .asm files processed by NASM, directly countering the lack of bounds checks in obj_directive().