CVE-2026-6068 CVE-2026-6068
A heap use-after-free in NASM's response file processing allows attackers to cause data corruption or execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6068?
CVE-2026-6068 is a medium-severity use after free vulnerability in Nasm Netwide Assembler, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NASM contains a heap use after free vulnerability in response file (-@) processing where a dangling pointer to freed memory is stored in the global depend_file and later dereferenced, as the response-file buffer is freed before the pointer is used, allowing for data corruption or remote code execution.
Weakness: CWE-416
Which versions are affected by CVE-2026-6068?
It affects 1 product.
Products include Nasm Netwide Assembler.
How do I fix CVE-2026-6068?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-6068 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-6068 exists.
Other vulnerabilities in Nasm Netwide Assembler
Sources
Also known as DEBIAN-CVE-2026-6068, GHSA-wwjw-6p2f-76rh, UBUNTU-CVE-2026-6068.