OW2 ASM 3.0 prior to version 9.11 contains an excessive memory allocation flaw in the method that handles return instructions of subroutines. A malformed class file with multiple RET instructions for a single subroutine can provoke the allocation of roughly 2 GB of memory, which causes the Java Virtual Machine to crash. The flaw is a classic example of CWE‑789, where unsafely large memory allocations can destabilize an application.

The vulnerability affects the OW2 ASM library, specifically versions up to and including 9.10.1. Any Java application or framework that incorporates OW2 ASM 3.0‑9.10.1 and processes custom or third‑party class files is potentially impacted.

The CVSS score of 6.8 indicates moderate severity. The EPSS score of 0.00172 translates to an extremely low probability of exploitation, and the issue is not listed in CISA’s KEV catalog. The overall likelihood of active exploitation remains low, though a successful attack would still cause the JVM to crash, resulting in a denial of service. The likely attack vector remains delivery of a crafted invalid class file through dynamic class loading or other mechanisms that accept external class inputs.