NASM’s disasm() function contains a stack‑based buffer overflow when formatting disassembly output. The overflow occurs if the slen parameter exceeds the internal buffer, causing an out‑of‑bounds write on the stack. This flaw can corrupt memory and, based on the nature of the overflow, it is inferred that an attacker could potentially execute arbitrary code or compromise the integrity of the running program.

NASM, the Netwide Assembler, is affected. The CVE explicitly lists version 3.02 rc5 as vulnerable; other releases that share the same vulnerable build of disasm() should be considered at risk until a patch is applied.

The CVSS score of 7.5 indicates medium to high severity, while the EPSS score of less than 1% suggests it is unlikely to be widely exploited at present. The vulnerability is not included in the CISA KEV catalog, indicating no currently observed widespread exploitation. Exploitation would require an attacker to supply a disassembly string with a slen large enough to overflow the stack; this is inferred to be achievable through local or remote code that calls disasm() on untrusted input.