A heap buffer overflow vulnerability exists in the Netwide Assembler (NASM) due to a lack of bounds checking in the obj_directive() function. This vulnerability can be exploited by a user assembling a malicious .asm file, potentially leading to heap memory corruption, denial of service (crash), and arbitrary code execution.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21333-1 advisory.

    This update for nasm fixes the following issues

    - CVE-2026-6067: heap buffer overflow vulnerability due to a lack of bounds checking in the     obj_directive() function       (bsc#1261986).
    - CVE-2026-6068: heap use after free vulnerability in response file processing (bsc#1261985).

    Changes for nasm:

    - Update to 3.02:

     * Fix build problems on C23 compilers using a pre-C23 version of <stdbool.h>      which defines bool as a macro in violation of the C23 specification.
     * The immediate form of the JMPE instruction (opcode 0F B8) has been changed      to an absolute address, as in the Itanium Architecture Software Developer's      Manual, version 2.3, Volume 4, page 4:249. Hopefully this won't break      whatever virtual environments use JMPE, but it is the closest thing there      is to an official specification for this opcode.
     * Being an absolute address, treat it equivalent to a FAR jump and do not      default to 64 bits in 64-bit mode.
     * That JMPE has apparently been wrong all these years is probably as good of      a hint as any how much it has been actually used, but it does have the      possibility of breaking virtual environments. In that case, please file a      bug report to https://bugs.nasm.us with details about the virtual      environment, and we will figure out a suitable solution.
     * Various build fixes. Fix the documentation not building on MacOS because of      the cp utility lacking -u there. Also fix not building generally due to      wrong link formatting. Another fix was a typo in compiler.h related to a      C++ check.
     * Corrections to assembling encodings:
     + Fix CMP allowing LOCK which is illegal.
     + Correct multiple AVX512 instructions such as VCVTSD2SI, VCVTSD2USI,      VCVTSS2SI, VCVTSS2USI, VCVTTSD2SI, VCVTTSD2USI, VCVTTSS2SI, VCVTTSS2USI,      VGETEXPSH, VGETMANTSH, MOVDDUP, VMOVDDUP.
     + Fixed other encodings or instruction formats for instructions UWRMSR,      CMPSD, VCMPSS, V4FMADDSS, V4FNMADDSS, VCVTDQ2PH, VCVTPD2PH, VCVTPH2UDQ,      VCVTQQ2PH, VCVTUDQ2PH, VCVTUQQ2PH, VGETEXPSH, VGETMANTSH, VRCPPH,      VRSQRTPH, VCVTPH2BF8, VCVTPH2BF8S, VCVTPH2HF8, VCVTPH2HF8S.
     + Fixed typos in VP4DPWSSD mnemonic.
     + Fixed BYTE and WORD operands getting the same encoding on arithmetic      instructions such as CMP.
     + Fixed PUSH not assembling when used with a DWORD in 64-bit mode. This is      not a recommended syntax as the operand size is still 64 bits, but was      permitted by earlier versions of NASM.
     + Fix parsing of $--escaped symbols in directives (GLOBAL, STATIC, EXTERN,      REQUIRED, COMMON).
     * Corrections to disassembling:
     + Shift instructions with the unity operand were getting disassembled to a      zero operand instead of one.
     + JMP, CALL and JMPE disassembled incorrectly with the register operands.
     * Whole bunch of minor fixes to operand sizes, operand size prefixes. Changes      mostly return the behavior known from 2.16.03.
     * MOV [mem], label would be accepted without size specifiers which could      cause unintended consequences. Raise an error if no size was specified and      one of the operands is a memory reference and another operands is a label.
     * JMP NEAR is now the same as JMP STRICT NEAR as the STRICT is redundant      here. JMP WORD on the other hand is up for optimization as NEAR and WORD      relate to different things -- jump lengths and operation sizes respectively.
     * Using redundant (or not) but valid operands size prefixes was fixed on      instructions such as IRET, PUSHF, POPF, PUSH and POP.
     * Using an operand size prefix on a JMP or CALL instruction could generate an      invalid instruction. This appears to have been a long-standing bug.
     Specifying the operand size by specifying the size of the immediate      explicitly (e.g. JMP DWORD label) has always worked correctly, however.
     * Add support for C2y-style \o escape sequences, braced escape sequences, and      as NASM extensions, decimal escape sequences (\d) and control-character      escape sequences (\^). See section 3.4.2.
     * Fix generation of the short opcodes for ADD, OR, ADC, SBB, AND, SUB, XOR, and CMP AL,imm8.
     * Fix truncation of the generated constant to 63 bits when invoking a      single-line macro when an argument is defined as =/b or =/ub.
     * Add an %env() preprocessor function as a more robust and flexible      alternative to the %! construct. See section 5.5.7.
     * The maximum number of multi-line macro parameters is now a configurable      limit. See section 2.1.32.
     * The --limit- options and %pragma limit now accept the keywords default,      maximum, and reset. See section 2.1.32.
     * Fix parsing of seg:offs--style FAR pointers in EQU.
     * Fix the %clear preprocessor directive hanging when given parameters.
     * The never properly implemented (or documented) preprocessor directives      %rmacro and %irmacro are now properly disabled; to avoid breaking existing      code, they fall back to %macro and %imacro with a suitable warning.
     Programmers should not rely on this behavior: in the future, these      directives might actually be (properly) implemented.
     * New listing option -Lc to include the contents of INCBIN files, see section 2.1.4.
     * New listing option -Lt to include the output from every iteration of TIMES      and ALIGN directives, see section 2.1.4.
     * The %pragma list options directive now support resetting options to their      command-line default, see section 2.1.4.
     * New predefined macros __?LIST_OPTIONS?__ and __?LIST_OPTIONS_DEFAULT?__ to      query the active and command-line default listing options. See section 2.1.4.

    - Update to 3.01:

     * A new obj2 version of the obj output format, intended for use on OS/2. See section 9.5.
     * The condition after %if or %elif would be evaluated while output is suppressed      after %exitrep or %exitmacro. Although no output would be generated in either case,      assembly would fail if evaluating the expression triggered an error.
     * Fix encoding of TCVTROWPS2PHL, correct multiple AVX512-BF16 instructions' operand      formats and typoed mnemonics.
     * The unofficial but obvious alternate form TEST reg,mem was not accepted by NASM 3.00;
     corrected.
     * For the obj output format, multiple GROUP directives can now be specified for the same      group; the resulting group includes all sections specified in all GROUP directives for      the group.
     * A new %selbits() preprocessor function. See section 5.4.19.
     * A new --bits option as convenience shorthand for --before BITS .... See section 2.1.31.
     * The options and pragmas for configuring external label mangling were inconsistent, the      former using the spelling postfix and the latter suffix. Furthermore, these were also      documented as directives in addition to pragmas. Implement the already documented      directives (bracketed forms only) and allow both postfix and suffix in all cases.
     See section 2.1.28 and section 8.10.
     * Define additional permissive patterns and fix several opcode bugs.
     * Fix parsing of two-operand forms of x87 instructions.
     * Fix bogus absolute address can not be RIP-relative warning.
     * Hopefully fix building with OpenWatcom.
     * Generate a warning, promoted to error by default, on the use of o64 prefixes in      16- or 32-bit mode. If demoted to a warning or suppressed the prefix is ignored, but      likely will trigger subsequent, harder to debug, error messages.
     * More consistent handling of jump and call instructions with specified operand sizes.
     * Fix an operand size handling bug in the CMPXCHG instruction.

    - Update to 3.00:

     * Improve the documentation for building from source (appendix D).
     * Add support for the APX and AVX10 instruction sets, and various miscellaneous new instructions.
     * Add new preprocessor functions: %b2hs(), %chr(), %depend(), %find(),      %findi(), %hs2b(), %null(), %ord(), %pathsearch(), and %realpath(). See section 5.4.
     * New preprocessor directive %note to insert a note in the list file,      without issuing an external diagnosic. Unlike a comment, it is optionally      macro-expanded, see section 5.11.
     * New preprocessor directive %iffile (and corresponding function %isfile()) to      test for the existence of a file. See section 5.6.12.
     * New preprocessor directive %ifdirective to test for the existence of a      preprocessor directive, assembly directive, or pseudo-instruction; see section 5.6.10.
     * Fix a number of invalid memory references (usually causing crashes) on various invalid inputs.
     * Fix multiple bugs in the handling of $--escaped symbols.
     * The use of $ as a prefix for hexadecimal numbers has been deprecated,      and will now issue a warning. A new directive [DOLLARHEX] can be used to disable      this syntax entirely, see section 8.12.
     * Fix the generation of segment selector references (mainly used in the obj output format.)
     * Fix crash in the obj backend when code was emitted into the default segment,      without any labels having been defined.
     * Clean up the command-line help text (-h) and break it down into individual      topics, as the previous output was just too verbose to be practical as a quick reference.
     * The implicit DEFAULT ABS in 64-bit mode is deprecated and may be changed to REL      in the future. See section 8.2. A warning is now emitted for this condition.
     * It is now possible to set the REL/ABS default for memory accesses using FS: or GS:,      see section 8.2.
     * The __?DEFAULT?__ standard macro now reflects the settings of the DEFAULT directive.
     See section 6.4.
     * The NASM preprocessor now assumes that an unknown directive starting with %if or %elif      is a misspelled or not yet implemented conditional directive, and tries to match it      with a corresponding %endif. See section 5.6.14.
     * The masm macro package now defines a macro for x87 register syntax. See section 7.5.
     * A new macro package, vtern, to simplify generation of the control immediates for      the VPTERNLOGD and VPTERNLOGQ instructions. See section 7.6.
     * A new command line option -LF allows overriding [LIST -] directives.
     * In the obj output format, allow a segment in the FLAT pseudo-group to also belong to      another (real) group. Used on OS/2.
     * Add a new build_version directive to the Mach-O backend. See section 9.8.6.
     * Fix a spec violation in the generation of DWARF debugging information on ELF.
     * Response files can now be nested.
     * Many documentation improvements.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-eaae48ece0 advisory.

    Fix for CVE-2026-6067 .


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c346e5cd24 advisory.

    Automatic update for nasm-3.01-3.fc45.

    ##### **Changelog**

    ```
    * Wed Apr 22 2026 Dominik Mierzejewski <rpm@greysector.net> - 3.01-3
    - fix CVE-2026-6067 (resolves rhbz#2458087, rhbz#2458089)       patch by Nick Clifton

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A heap buffer overflow vulnerability exists in the Netwide Assembler (NASM) due to a lack of bounds     checking in the obj_directive() function. This vulnerability can be exploited by a user assembling a     malicious .asm file, potentially leading to heap memory corruption, denial of service (crash), and     arbitrary code execution. (CVE-2026-6067)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
327237	openSUSE 16 Security Update : nasm (openSUSE-SU-2026:21333-1)	Nessus	SuSE Local Security Checks	critical
319618	Fedora 44 : nasm (2026-eaae48ece0)	Nessus	Fedora Local Security Checks	medium
318794	Fedora 45 : nasm (2026-c346e5cd24)	Nessus	Fedora Local Security Checks	medium
307033	Linux Distros Unpatched Vulnerability : CVE-2026-6067	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-6067

medium

Tenable Plugins

critical

medium

medium

medium