Nasm vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-6069 NASM’s disasm() function contains a stack based buffer overflow when formatting disassembly output, allowing an attacker triggered out-of-bounds write when `sleHigh 7.5 · Apr 10, 2026
• CVE-2026-6068 NASM contains a heap use after free vulnerability in response file (-@) processing where a dangling pointer to freed memory is stored in the global depend_file Critical 9.6 · Apr 10, 2026
• CVE-2023-31722 There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).High 7.8 · May 17, 2023
• CVE-2022-44370 NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856High 7.8 · Mar 29, 2023
• CVE-2020-24978 In NASM 2.15.04rc3, there is a double-free vulnerability in pp_tokline asm/preproc.c.Critical 9.8 · Sep 3, 2020
• CVE-2019-20352 In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set_text_free when called from expand_one_smacro in asm/pHigh 7.1 · Jan 6, 2020
• CVE-2019-8343 In Netwide Assembler (NASM) 2.14.02, there is a use-after-free in paste_tokens in asm/preproc.c.High 7.8 · Feb 15, 2019
• CVE-2018-19216 Netwide Assembler (NASM) before 2.13.02 has a use-after-free in detoken at asm/preproc.c.High 7.8 · Nov 12, 2018
• CVE-2018-19215 Netwide Assembler (NASM) 2.14rc16 has a heap-based buffer over-read in expand_mmac_params in asm/preproc.c for the special cases of the % and $ and ! charactersHigh 7.8 · Nov 12, 2018
• CVE-2018-19214 Netwide Assembler (NASM) 2.14rc15 has a heap-based buffer over-read in expand_mmac_params in asm/preproc.c for insufficient input.High 7.8 · Nov 12, 2018
• CVE-2018-10254 Netwide Assembler (NASM) 2.13 has a stack-based buffer over-read in the disasm function of the disasm/disasm.c file.High 7.8 · Apr 21, 2018
• CVE-2018-8883 Netwide Assembler (NASM) 2.13.02rc2 has a buffer over-read in the parse_line function in asm/parser.c via uncontrolled access to nasm_reg_flags.High 7.8 · Mar 20, 2018
• CVE-2018-8882 Netwide Assembler (NASM) 2.13.02rc2 has a stack-based buffer under-read in the function ieee_shr in asm/float.c via a large shift value.High 7.8 · Mar 20, 2018
• CVE-2018-8881 Netwide Assembler (NASM) 2.13.02rc2 has a heap-based buffer over-read in the function tokenize in asm/preproc.c, related to an unterminated string.High 7.3 · Mar 20, 2018
• CVE-2017-17818 In Netwide Assembler (NASM) 2.14rc0, there is a heap-based buffer over-read that will cause a remote denial of service attack, related to a while loop in paste_High 7.5 · Dec 20, 2017
• CVE-2017-11111 In Netwide Assembler (NASM) 2.14rc0, preproc.c allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibHigh 7.8 · Jul 8, 2017
• CVE-2017-10686 In Netwide Assembler (NASM) 2.14rc0, there are multiple heap use after free vulnerabilities in the tool nasm.High 7.8 · Jun 29, 2017
• CVE-2008-7177 Buffer overflow in the listing module in Netwide Assembler (NASM) before 2.03.01 has unknown impact and attack vectors, a different vulnerability than CVE-2008-High 9.3 · Sep 8, 2009
• CVE-2004-1287 Buffer overflow in the error function in preproc.c for NASM 0.98.38 1.2 allows attackers to execute arbitrary code via a crafted asm file, a different vulnerabiHigh 10 · Jan 10, 2005