CVE-2020-24241
In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.
In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.
- Record
CVE-2020-24241- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.
- Record
CVE-2020-24241- Updated
- 2026-11-02
EUVDEUVD-2020-16976 No score
In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.
- Record
EUVD-2020-16976- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x2g3-wj9f-6wcx No score
In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.
In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.
- Record
GHSA-x2g3-wj9f-6wcx- Updated
- 2026-11-02
OSV
In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.
- Record
CVE-2020-24241- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-24241
In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.
- Record
DEBIAN-CVE-2020-24241- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2021-1022
nasm security update
NASM is the Netwide Assembler, a free portable assembler for the Intel 80x86 microprocessor series, using primarily the traditional Intel instruction mnemonics and syntax. It also provides tools in RDOFF binary format, includes linker, library manager, loader, and information dump.\r\n\r\n Security Fix(es):\r\n\r\n In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set_text_free when called from expand_one_smacro in asm/preproc.c.(CVE-2019-20352)\r\n\r\n In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.(CVE-2020-24241)\r\n\r\n
- Record
OESA-2021-1022- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-24241
In Netwide Assembler (NASM) 2.15rc10, there is heap use-after-free in saa_wbytes in nasmlib/saa.c.
- Record
UBUNTU-CVE-2020-24241- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nasmDebian:12 |
before 2.15.04-1 | 2.15.04-1 |
nasmDebian:13 |
before 2.15.04-1 | 2.15.04-1 |
nasmDebian:14 |
before 2.15.04-1 | 2.15.04-1 |
nasmopenEuler:20.03-LTS From an advisory covering 2 CVEs |
before 2.15.03-2.oe1 | 2.15.03-2.oe1 |
nasmopenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 2.15.03-2.oe1 | 2.15.03-2.oe1 |
nasmUbuntu:16.04:LTS |
All versions, plus listed versions 2.11.06-1really2.11.05-12.11.08-12.11.08-1ubuntu0.1 |
None known |
nasmUbuntu:18.04:LTS |
All versions, plus listed versions 2.13.01-22.13.02-0.1 |
None known |
nasmUbuntu:20.04:LTS |
All versions, plus listed versions 2.14.02-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-24241 is a medium vulnerability (CVSS 5.5) in Nasm Netwide Assembler, published August 25, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 56th percentile. Fixed in nasm 2.15.04-1.