yasm 1.3.0.55.g101bc has a segmentation violation in the function delete_Token at…
Priority MEDIUM 58Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
yasm 1.3.0.55.g101bc has a segmentation violation in the function delete_Token at modules/preprocs/nasm/nasm-pp.c. NOTE: although a libyasm application could become unavailable if this were exploited, the vendor's position is that there is no security relevance because there is either supposed to be input validation before data reaches libyasm, or a sandbox in which the application runs.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00339 27th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:yasm_project:yasm:1.3.0.55.g101bc:*:*:*:*:*:*:* | 1.3.0.55.g101bc | Vulnerable | Yasm Project |
- cpe:2.3:a:yasm_project:yasm:1.3.0.55.g101bc:*:*:*:*:*:*:* Versions 1.3.0.55.g101bc Vulnerable ·Yasm Project
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2023-29581
- 2026-10-03 Alias added: GHSA-fcm2-5r3h-4j86
References
More Yasm Project Yasm vulnerabilities
- TI-2023-27061 An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via… CVSS 3.1MEDIUM 5.5
- TI-2023-13935 yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the function… CVSS 3.1MEDIUM 6.2
- TI-2023-27062 An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via… CVSS 3.1MEDIUM 5.5
- TI-2023-27060 Buffer Overflow vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a… CVSS 3.1MEDIUM 5.5
- TI-2023-27059 An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via… CVSS 3.1MEDIUM 5.5
- TI-2023-27058 Use After Free vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a… CVSS 3.1MEDIUM 5.5
Sources
- CVE-2023-29581 · CVE Program
- CVE-2023-29581 · NVD
- FIRST EPSS
- GHSA-fcm2-5r3h-4j86 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-29581 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences