Read the docs
TI-2025-08095 Aliases CVE-2025-8844GHSA-3r2j-2686-wg8h

NASM Netwide Assember preproc.c parse_smacro_template null pointer dereference

Priority MEDIUM 55CWE-404Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-404.

Summary

A vulnerability was determined in NASM Netwide Assember 2.17rc0. This vulnerability affects the function parse_smacro_template of the file preproc.c. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00291 21st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NASMNetwide Assember2.17rc0—No fix listedCNA
  • Netwide Assember VendorNASM Affected 2.17rc0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nasm:netwide_assembler:2.17:rc0:*:*:*:*:*:*2.17 rc0VulnerableNASM
  • cpe:2.3:a:nasm:netwide_assembler:2.17:rc0:*:*:*:*:*:* Versions 2.17 rc0 Vulnerable ·NASM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-8844
  2. 2026-10-03 Alias added: GHSA-3r2j-2686-wg8h

References

Exploit 2

  • TI-2026-05320 Use after free in NASM CVSS 3.1CRITICAL 9.6
  • TI-2026-05321 Out-of-bounds write in NASM CVSS 3.1HIGH 7.5
  • TI-2026-05319 Out-of-bounds write in NASM CVSS 3.1HIGH 7.5
  • TI-2004-01165 Buffer overflow in the error function in preproc.c for NASM 0.98.38 1.2 allows attackers… CVSS 2.0HIGH 10.0
  • TI-2023-20017 Stack-based buffer over-read in disasm in nasm 2.16 allows attackers to cause a denial of service (crash). CVSS 3.1MEDIUM 5.5
  • TI-2023-20016 Stack-based buffer over-read in function disasm in nasm 2.16 allows attackers to cause a denial of service. CVSS 3.1MEDIUM 5.5
See all 74 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences