Executive brief
The Netwide Assembler (NASM), a widely used tool for converting assembly code into executable programs, contains a memory safety flaw in how it handles 'response files' used for command-line arguments. An attacker can exploit this by providing a specially crafted project or source file that, when compiled by a user, allows the attacker to overwrite arbitrary files on the user's system. In a real-world scenario, this could lead to a full system compromise (Remote Code Execution) by silently overwriting configuration files like .bashrc during a routine software build process.
Technical details
A heap use-after-free (UAF) vulnerability exists in NASM's 'process_respfile' function within 'asm/nasm.c'. When processing the '-@' argument, a global pointer 'depend_file' is assigned to a location within a temporary heap-allocated buffer. This buffer is freed before the pointer is dereferenced in 'parse_cmdline' or 'emit_dependencies'. An attacker can reclaim the freed heap chunk by triggering specific allocations (e.g., via long label names) to control the 'depend_file' string. Because this string is subsequently used as a filename in an 'fopen' call with write permissions, and because NASM fails to escape shell metacharacters like semicolons or pipes in dependency outputs, an attacker can achieve arbitrary file writes and command injection. The vulnerability is unpatched as of the advisory date.
Affected products
- NASM Development Team Netwide Assembler (NASM) 3.02:rc5 and likely earlier versions
Timeline
- 2026-03-31: disclosed: Vulnerability reported to NASM maintainers via GitHub issues.
- 2026-04-10: advisory: CVE-2026-6068 assigned via CERT/CC after no vendor response.
- 2026-05-18: other: Detailed exploit analysis and RCE proof-of-concept published by Project SEKAI.