CVE-2026-6069: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-6069 is a stack-based buffer overflow vulnerability in NASM's (Netwide Assembler) disasm() function that can cause an out-of-bounds write when formatting disassembly output. The flaw is triggered when the internal slen variable exceeds the caller-provided output buffer capacity. It affects NASM version 3.02-rc5 and was published on April 10, 2026. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory).

The root cause is classified as CWE-787 (Out-of-bounds Write). Within disasm/disasm.c, the disasm() function mixes bounded snprintf() calls with direct, unchecked writes to the output buffer — including output[slen++] = separator (line 1472), memcpy(&output[slen], "{dfv=", 5) (line 1525), and the null-terminator write output[slen] = '\0' (line 1715). When slen grows to meet or exceed outbufsize, these paths write past the end of the stack-allocated buffer. A researcher reproduced the issue by calling disasm(data, INSN_MAX, outbuf, 8, 32, 0, 0, &prefer) with a deliberately small 8-byte output buffer and simple instruction bytes (0x89, 0xC0) under AddressSanitizer (NASM Issue #217). NASM maintainers have noted that in real-world deployment, disasm() has only one caller (the ndisasm program) which uses a 256-byte buffer, making actual overflow unlikely in production (NASM Issue #217).

The primary confirmed impact is a denial of service — a reliable crash of the NASM disassembler process when triggered under artificial buffer constraints. Depending on the embedding context, compiler, and stack layout, memory corruption beyond a crash is theoretically possible, but no integrity or confidentiality impact has been demonstrated. The CVSS scoring reflects no confidentiality or integrity impact, with high availability impact (Github Advisory).

No confirmed real-world exploit exists for this vulnerability. The EPSS score is approximately 0.04% (0.000400), indicating a very low probability of exploitation in the near term. Feedly's analysis of the referenced GitHub issue concluded the reported PoC is non-exploitable in production, as it requires calling an internal NASM function with artificially constrained buffer sizes that do not occur in actual NASM deployment. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (NASM Issue #217, Github Advisory).

1. Identify target: Locate a system or application that embeds NASM's disasm() function and exposes it to attacker-controlled input, particularly with a small caller-provided output buffer smaller than what a disassembled instruction may produce.
2. Craft malicious input: Prepare binary instruction bytes (e.g., 0x89, 0xC0) or more complex instruction sequences that, when disassembled, produce output exceeding the buffer size passed to disasm().
3. Trigger the overflow: Supply the crafted bytes as input to the vulnerable disasm() call with a constrained outbufsize parameter, causing slen to exceed the buffer boundary and triggering the out-of-bounds write at disasm/disasm.c:1715.
4. Achieve DoS: The out-of-bounds write causes a crash (stack corruption), resulting in denial of service of the affected process. Note: In standard ndisasm usage with a 256-byte buffer, this condition is not reachable in practice (NASM Issue #217).

A patch is available via GitHub Advisory GHSA-pfc2-7mmr-x54w; users should update NASM to a version that includes the fix for this buffer overflow. As a workaround, restrict network or untrusted access to any system or service that invokes NASM's disasm() function with externally supplied input. NixOS users should track the upstream fix via the related NixPkgs issue. Given that the vulnerability is disputed as non-exploitable in standard deployment, risk prioritization should be moderate (Github Advisory).

NASM maintainers disputed the severity of the report, noting that disasm() is an internal function with only one real caller (ndisasm) that uses a 256-byte buffer, making actual overflow impossible in standard usage. The issue was nonetheless assigned a CVE and published to the GitHub Advisory Database as High severity. A NixOS/nixpkgs tracking issue was opened in response to the disclosure (NASM Issue #217).