CVE-2026-6068

CVE-2026-6068 is a heap use-after-free vulnerability in NASM (Netwide Assembler) that occurs during response file processing with the -@ flag. When processing response files, the application frees the buffer containing file data but retains a dangling pointer in the global depend_file variable, which is subsequently dereferenced, potentially leading to memory corruption or unexpected program behavior. The vulnerability carries a CVSS score of 6.5 (MEDIUM severity) with a network-accessible attack vector requiring no authentication or user interaction. The attack has low complexity and results in partial impacts to confidentiality and integrity, though availability is not affected. The EPSS score of 0.00032 indicates minimal real-world exploitation likelihood relative to other CVEs. There is no evidence of active exploitation in the wild. The vulnerability is not tracked on the Known Exploited Vulnerabilities (KEV) catalog, remains inactive on exploit hot lists, and no public proof-of-concept code is reported to be available. Community attention and exploitation potential remain low at this time.