NASM implements a heap use‑after‑free bug in its response file (-@) handling. A dangling pointer to freed memory is stored in the global depend_file and later dereferenced when the response-file buffer is freed, leading to memory corruption or remote code execution. The weakness is a classic heap use‑after‑free error (CWE‑416). An attacker could exploit the vulnerability by supplying a crafted response file, potentially altering program state or executing arbitrary code.

The Netwide Assembler (NASM) is the affected product, specifically version 3.02 RC5 as identified by the CPE string. The vulnerability resides in the response-file parser. No other vendors or products are listed.

The CVSS score of 6.5 places this vulnerability in the moderate severity range. EPSS score is less than 1% and the flaw is not in the CISA KEV catalog, indicating no widespread exploitation. The likely attack vector is local; a user who supplies a crafted response file when invoking NASM can trigger the use‑after‑free. Remote exploitation would require NASM to be exposed as a network‑serviced component, which is unlikely in typical use. The vulnerability may lead to data corruption or remote code execution if the attacker chains it with additional weaknesses.