PatchaPalooza

CVE-2026-110259: OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions()

CVE-2026-110259 is a vulnerability in OW2 ASM 3.0 before 9.11 Uncontrolled Recursion via ClassWriter.replaceAsmInstructions(), rated Moderate by Microsoft, with a CVSS 3.1 base score of 5.5 (Medium). An attacker can exploit it by an attacker with local access, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.17% probability of exploitation activity in the next 30 days, higher than 6% of all scored vulnerabilities. Microsoft released the fix on 31 October 2026, outside Patch Tuesday. It affects 2 products in 1 product family (Open Source Software).

Key facts

CVE ID
CVE-2026-110259
Severity
Medium CVSS 5.5
Microsoft severity
Moderate
Exploited in the wild
No
Publicly disclosed
No
Weakness
CWE-674
EPSS
0.17% (percentile 6%)
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
October 2026 Patch Tuesday
Product families
Open Source Software

CVSS score and vector

Microsoft scores CVE-2026-110259 at 5.5 (temporal 5.5) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

MetricValue
Attack vectorLocal
Attack complexityLow
Privileges requiredNone
User interactionRequired
ScopeUnchanged
Confidentiality impactNone
Integrity impactNone
Availability impactHigh

Affected products (2)

Open Source Software

ProductSecurity updateTypeFixed buildRestart
azl3 javapackages-bootstrap 1.14.0-4 on Azure Linux 3.0Release NotesSecurity Update
azl3 objectweb-asm 9.6-1 on Azure Linux 3.0Release NotesSecurity Update

NIST NVD data

NVD status
Awaiting Analysis
NVD CVSS
5.5 (MEDIUM)
NVD weakness
CWE-674
Published to NVD
NVD last modified

References

Revision history

VersionDateDescription
1.0Information published.

Sources