NASM v2.16 was discovered to contain a null pointer deference in the NASM component
Priority MEDIUM 58CWE-476Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Will not fix Red Hat: no fix planned
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-476.
Summary
NASM v2.16 was discovered to contain a null pointer deference in the NASM component
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00311 24th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Will not fix Red Hat: no fix planned
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nasm:netwide_assembler:2.16:-:*:*:*:*:*:* | 2.16 | Vulnerable | NASM |
| cpe:2.3:a:nasm:netwide_assembler:2.16:rc0:*:*:*:*:*:* | 2.16 rc0 | Vulnerable | NASM |
| cpe:2.3:a:nasm:netwide_assembler:2.16:rc10:*:*:*:*:*:* | 2.16 rc10 | Vulnerable | NASM |
| cpe:2.3:a:nasm:netwide_assembler:2.16:rc11:*:*:*:*:*:* | 2.16 rc11 | Vulnerable | NASM |
| cpe:2.3:a:nasm:netwide_assembler:2.16:rc12:*:*:*:*:*:* | 2.16 rc12 | Vulnerable | NASM |
| cpe:2.3:a:nasm:netwide_assembler:2.16:rc4:*:*:*:*:*:* | 2.16 rc4 | Vulnerable | NASM |
| cpe:2.3:a:nasm:netwide_assembler:2.16:rc5:*:*:*:*:*:* | 2.16 rc5 | Vulnerable | NASM |
| cpe:2.3:a:nasm:netwide_assembler:2.16:rc6:*:*:*:*:*:* | 2.16 rc6 | Vulnerable | NASM |
| cpe:2.3:a:nasm:netwide_assembler:2.16:rc7:*:*:*:*:*:* | 2.16 rc7 | Vulnerable | NASM |
| cpe:2.3:a:nasm:netwide_assembler:2.16:rc8:*:*:*:*:*:* | 2.16 rc8 | Vulnerable | NASM |
- cpe:2.3:a:nasm:netwide_assembler:2.16:-:*:*:*:*:*:* Versions 2.16 Vulnerable ·NASM
- cpe:2.3:a:nasm:netwide_assembler:2.16:rc0:*:*:*:*:*:* Versions 2.16 rc0 Vulnerable ·NASM
- cpe:2.3:a:nasm:netwide_assembler:2.16:rc10:*:*:*:*:*:* Versions 2.16 rc10 Vulnerable ·NASM
- cpe:2.3:a:nasm:netwide_assembler:2.16:rc11:*:*:*:*:*:* Versions 2.16 rc11 Vulnerable ·NASM
- cpe:2.3:a:nasm:netwide_assembler:2.16:rc12:*:*:*:*:*:* Versions 2.16 rc12 Vulnerable ·NASM
- cpe:2.3:a:nasm:netwide_assembler:2.16:rc4:*:*:*:*:*:* Versions 2.16 rc4 Vulnerable ·NASM
- cpe:2.3:a:nasm:netwide_assembler:2.16:rc5:*:*:*:*:*:* Versions 2.16 rc5 Vulnerable ·NASM
- cpe:2.3:a:nasm:netwide_assembler:2.16:rc6:*:*:*:*:*:* Versions 2.16 rc6 Vulnerable ·NASM
- cpe:2.3:a:nasm:netwide_assembler:2.16:rc7:*:*:*:*:*:* Versions 2.16 rc7 Vulnerable ·NASM
- cpe:2.3:a:nasm:netwide_assembler:2.16:rc8:*:*:*:*:*:* Versions 2.16 rc8 Vulnerable ·NASM
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
Timeline
- 2026-10-02 Threatist record created from CVE-2022-44368
- 2026-10-03 Alias added: GHSA-5w68-r965-r3m3
References
More NASM Netwide Assembler vulnerabilities
- TI-2026-05320 Use after free in NASM CVSS 3.1CRITICAL 9.6
- TI-2026-05321 Out-of-bounds write in NASM CVSS 3.1HIGH 7.5
- TI-2026-05319 Out-of-bounds write in NASM CVSS 3.1HIGH 7.5
- TI-2004-01165 Buffer overflow in the error function in preproc.c for NASM 0.98.38 1.2 allows attackers… CVSS 2.0HIGH 10.0
- TI-2023-20017 Stack-based buffer over-read in disasm in nasm 2.16 allows attackers to cause a denial of service (crash). CVSS 3.1MEDIUM 5.5
- TI-2023-20016 Stack-based buffer over-read in function disasm in nasm 2.16 allows attackers to cause a denial of service. CVSS 3.1MEDIUM 5.5
Sources
- CVE-2022-44368 · CVE Program
- CVE-2022-44368 · NVD
- FIRST EPSS
- GHSA-5w68-r965-r3m3 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-44368 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences