A heap buffer overflow exists in Netwide Assembler's obj_directive() function due to omitted bounds checking. When an attacker supplies a specially crafted assembly file, the overflow can corrupt heap memory, trigger a crash, or enable arbitrary code execution. The weakness corresponds to CWE‑120, Buffer Copy without Checking Size of Input, and CWE‑787, Buffer Access with Improper Check.

The vulnerability affects the Netwide Assembler (NASM). The advisory does not list specific affected versions, so users should refer to the vendor’s release notes or security bulletin for version details. The issue applies to installations that compile or assemble code on a local machine or within build environments.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of current exploitation. The vulnerability is not listed in CISA's KEV catalog. Exploitation requires the ability to run NASM on a system with access to an attacker‑crafted assembly file; therefore the attack vector is likely local or depends on user privileges, but could be amplified in CI/CD pipelines that automatically assemble untrusted code.