Nasm maintains the Netwide Assembler, a widely used cross-platform assembly language compiler that, despite its narrow product focus, occupies a prominent place in the software build chain and development tooling landscape. The vendor's vulnerability profile concentrates on memory-safety issues across the assembler's parser and intermediate representation layers, with recurring classes including use-after-free conditions, out-of-bounds reads and writes, NULL-pointer dereferences, and improper memory-buffer restrictions. These weakness classes reflect the low-level nature of assembly processing and the complexity of managing heap state during compilation of untrusted or malformed input. Defenders should treat assembler updates as part of build-chain security audits, particularly in contexts where the assembler processes external or generated assembly code; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Nasm over time
Signals from CVEs in this vendor scope (75 CVEs).
75 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2004-1287HIGH Buffer overflow in the error function in preproc.c for NASM 0.98.38 1.2 allows attackers to execute arbitrary code via a crafted asm file, a different vulnerability than CVE-2005-1 | Jan 10, 2005 | 10.0 | 51 | NO | YES |
CVE-2026-6068CRITICAL NASM contains a heap use after free vulnerability in response file (-@) processing where a dangling pointer to freed memory is stored in the global depend_file and later dereferenc | Apr 10, 2026 | 9.6 | 32 | NO | NO |
CVE-2018-16517MEDIUM asm/labels.c in Netwide Assembler (NASM) is prone to NULL Pointer Dereference, which allows the attacker to cause a denial of service via a crafted file. | Sep 6, 2018 | 5.5 | 32 | NO | YES |
CVE-2008-2719MEDIUM Off-by-one error in the ppscan function (preproc.c) in Netwide Assembler (NASM) 2.02 allows context-dependent attackers to cause a denial of service (crash) and possibly execute ar | Jun 16, 2008 | 6.8 | 31 | NO | YES |
CVE-2020-24978CRITICAL In NASM 2.15.04rc3, there is a double-free vulnerability in pp_tokline asm/preproc.c. This is fixed in commit 8806c3ca007b84accac21dd88b900fb03614ceb7. | Sep 4, 2020 | 9.8 | 28 | NO | NO |
CVE-2026-6069HIGH NASM’s disasm() function contains a stack based buffer overflow when formatting disassembly output, allowing an attacker triggered out-of-bounds write when `slen` exceeds the buffe | Apr 10, 2026 | 7.5 | 26 | NO | NO |
CVE-2025-8846HIGH A vulnerability has been found in NASM Netwide Assember 2.17rc0. Affected is the function parse_line of the file parser.c. The manipulation leads to stack-based buffer overflow. Th | Aug 11, 2025 | 7.8 | 25 | NO | NO |
CVE-2025-8845HIGH A vulnerability was identified in NASM Netwide Assember 2.17rc0. This issue affects the function assemble_file of the file nasm.c. The manipulation leads to stack-based buffer over | Aug 11, 2025 | 7.8 | 25 | NO | NO |
CVE-2025-8842HIGH A vulnerability has been found in NASM Netwide Assember 2.17rc0. Affected by this issue is the function do_directive of the file preproc.c. The manipulation leads to use after free | Aug 11, 2025 | 7.8 | 25 | NO | NO |
CVE-2022-44370HIGH NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856 | Mar 29, 2023 | 7.8 | 25 | NO | NO |
Signals from CVEs in this vendor scope (75 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Nasm.
Media articles that mention a CVE ID that affects a product developed by Nasm — matched by CVE ID, not by vendor name.