CVE-2019-20352
In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm...
In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set_text_free when called from expand_one_smacro in asm/preproc.c.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set_text_free when called from expand_one_smacro in asm/preproc.c.
- Record
CVE-2019-20352- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set_text_free when called from expand_one_smacro in asm/preproc.c.
- Record
CVE-2019-20352- Updated
- 2026-11-02
EUVDEUVD-2019-10905 No score
In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set_text_free when called from expand_one_smacro in asm/preproc.c.
- Record
EUVD-2019-10905- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m9qp-645h-mppv No score
In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm...
In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set_text_free when called from expand_one_smacro in asm/preproc.c.
- Record
GHSA-m9qp-645h-mppv- Updated
- 2026-11-02
OSV
In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set_text_free when called from expand_one_smacro in asm/preproc.c.
- Record
CVE-2019-20352- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-20352
In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set_text_free when called from expand_one_smacro in asm/preproc.c.
- Record
DEBIAN-CVE-2019-20352- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2021-1022
nasm security update
NASM is the Netwide Assembler, a free portable assembler for the Intel 80x86 microprocessor series, using primarily the traditional Intel instruction mnemonics and syntax. It also provides tools in RDOFF binary format, includes linker, library manager, loader, and information dump.\r\n\r\n Security Fix(es):\r\n\r\n In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set_text_free when called from expand_one_smacro in asm/preproc.c.(CVE-2019-20352)\r\n\r\n In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.(CVE-2020-24241)\r\n\r\n
- Record
OESA-2021-1022- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-20352
In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set_text_free when called from expand_one_smacro in asm/preproc.c.
- Record
UBUNTU-CVE-2019-20352- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nasmDebian:12 |
before 2.15.04-1 | 2.15.04-1 |
nasmDebian:13 |
before 2.15.04-1 | 2.15.04-1 |
nasmDebian:14 |
before 2.15.04-1 | 2.15.04-1 |
nasmopenEuler:20.03-LTS From an advisory covering 2 CVEs |
before 2.15.03-2.oe1 | 2.15.03-2.oe1 |
nasmopenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 2.15.03-2.oe1 | 2.15.03-2.oe1 |
nasmUbuntu:16.04:LTS |
All versions, plus listed versions 2.11.06-1really2.11.05-12.11.08-12.11.08-1ubuntu0.1 |
None known |
nasmUbuntu:18.04:LTS |
All versions, plus listed versions 2.13.01-22.13.02-0.1 |
None known |
nasmUbuntu:20.04:LTS |
All versions, plus listed versions 2.14.02-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-20352 is a high vulnerability (CVSS 7.1) in Nasm Netwide Assembler, published January 6, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 57th percentile. Fixed in nasm 2.15.04-1.
References
bugzilla.nasm.us/show_bug.cgi?id=3392636
nvd.nist.gov/vuln/detail/CVE-2019-20352
github.com/advisories/GHSA-m9qp-645h-mppv
security-tracker.debian.org/tracker/CVE-2019-20352
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1022
ubuntu.com/security/CVE-2019-20352
cve.org/CVERecord?id=CVE-2019-20352