NASM implements a use‑after‑free bug in its response file (-@) handling. A dangling pointer to freed memory is stored in the global depend_file and later dereferenced when the buffer is released, leading to memory corruption or unpredictable behaviour. The underlying weakness is a classic heap use‑after‑free error. An attacker could potentially exploit this to corrupt program state or cause a crash.

The Netwide Assembler (NASM) is the affected product. No specific version numbers are listed, so any release containing the vulnerable response‑file parser may be at risk. This issue is tied to the NASM codebase itself and is not limited to any particular operating system or distribution.

The CVSS score of 6.5 places this vulnerability in the moderate severity range. EPSS data is not available and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating no widespread public exploitation yet. The likely attack vector is local; a user who runs NASM with a crafted response file can trigger the use‑after‑free. While the damage is currently limited to memory corruption, an attacker with additional weaknesses could potentially execute arbitrary code. Remote exploitation is unlikely unless NASM is invoked by a network‑exposed service.