Based on the description, it is inferred that attackers can supply a specially crafted class file containing nested JSR/RET subroutines to the ASM library’s JSRInlinerAdapter. The adapter inlines these subroutines without enforcing memory or work limits, causing an exponential growth in required memory proportional to O(2^n). In practice, this leads to an OutOfMemoryError that causes the Java Virtual Machine to crash. The weakness is described by CWE-407 – Uncontrolled Memory Allocation. The resulting denial of service can halt applications relying on the JVM, potentially disrupting services.

Affected software is the OW2 ASM library, versions 3.0 through 9.10.x, prior to 9.11. ASM is widely incorporated in Java compilers, build tools, application servers, and instrumentation frameworks that process class files. Any system that loads and manipulates class files using these versions of ASM is susceptible to the crash if the attacker can supply such files.

The CVSS score of 6.8 indicates moderate severity. The EPSS score of 0.00172 (approximately 0.17%) suggests a low likelihood of exploitation, although the flaw is trivial to trigger in environments that accept untrusted class files. Based on the description, the likely attack vector is local or remote, requiring the attacker to deliver a class file to the JVM; therefore, no external network interaction beyond that delivery is needed for the exploit. The vulnerability does not provide code execution or privilege escalation but does cause service disruption. Because it is not listed in the CISA KEV catalog, there is currently no publicly verified exploitation in the wild, but the risk remains moderate to high for affected deployments.