Is CVE-2026-6068 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6068 being exploited in the wild.

How severe is CVE-2026-6068?

Medium severity, with a CVSS score of 6.5, published 10 April 2026.

Which products and versions are affected?

NASM Development Team Netwide Assembler (NASM) 3.02:rc5 and likely earlier versions.

Is there a fix for CVE-2026-6068?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-6068 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6068?

Check whether you run Nasm Netwide Assembler. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6068: NASM heap use after free in response file processing

CVE-2026-6068 · Severity: medium · CVSS 6.5 · Published 2026-04-10

The Netwide Assembler (NASM), a widely used tool for converting assembly code into executable programs, contains a memory safety flaw in how it handles 'response files' used for command-line arguments. An attacker can exploit this by providing a specially crafted project or source file that, when compiled by a user, allows the attacker to overwrite arbitrary files on the user's system. In a real-world scenario, this could lead to a full system compromise (Remote Code Execution) by silently overwriting configuration files like .bashrc during a routine software build process.

Technologies: Nasm Netwide Assembler. Vendors: Nasm.

Quick answers

Is CVE-2026-6068 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6068 being exploited in the wild.
How severe is CVE-2026-6068?: Medium severity, with a CVSS score of 6.5, published 10 April 2026.
Which products and versions are affected?: NASM Development Team Netwide Assembler (NASM) 3.02:rc5 and likely earlier versions.
Is there a fix for CVE-2026-6068?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-6068 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6068?: Check whether you run Nasm Netwide Assembler. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap use-after-free (UAF) vulnerability exists in NASM's 'process_respfile' function within 'asm/nasm.c'. When processing the '-@' argument, a global pointer 'depend_file' is assigned to a location within a temporary heap-allocated buffer. This buffer is freed before the pointer is dereferenced in 'parse_cmdline' or 'emit_dependencies'. An attacker can reclaim the freed heap chunk by triggering specific allocations (e.g., via long label names) to control the 'depend_file' string. Because this string is subsequently used as a filename in an 'fopen' call with write permissions, and because NASM fails to escape shell metacharacters like semicolons or pipes in dependency outputs, an attacker can achieve arbitrary file writes and command injection. The vulnerability is unpatched as of the advisory date.

Affected products

NASM Development Team Netwide Assembler (NASM) 3.02:rc5 and likely earlier versions

Timeline

2026-03-31: disclosed: Vulnerability reported to NASM maintainers via GitHub issues.
2026-04-10: advisory: CVE-2026-6068 assigned via CERT/CC after no vendor response.
2026-05-18: other: Detailed exploit analysis and RCE proof-of-concept published by Project SEKAI.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.