CVE-2026-6067 | Vulnetix

CVE-2026-6067 PUBLISHED CVSS 7.5 HIGH

Reported by certcc · Published April 10, 2026

A heap buffer overflow vulnerability exists in the Netwide Assembler (NASM) due to a lack of bounds checking in the obj_directive() function. This vulnerability can be exploited by a user assembling a malicious .asm file, potentially leading to heap memory corruption, denial of service (crash), and arbitrary code execution.

Risk scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Vendor	Product	Versions
NASM	NASM	nasm-3.02rc5
NASM	NASM	3.02

Timeline

Apr 10, 2026 CVE Published
Apr 10, 2026 PoC Published
Apr 10, 2026 CVE Updated
Apr 10, 2026 Security Advisory
Apr 11, 2026 EPSS Score (30 in total, the first dated here)
Jun 26, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-6067
vulnetix vdb fixes CVE-2026-6067

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-6067/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →