CVE-2020-24978
In NASM 2.15.04rc3, there is a double-free vulnerability in pp_tokline asm/preproc.c. This is...
In NASM 2.15.04rc3, there is a double-free vulnerability in pp_tokline asm/preproc.c. This is fixed in commit 8806c3ca007b84accac21dd88b900fb03614ceb7.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In NASM 2.15.04rc3, there is a double-free vulnerability in pp_tokline asm/preproc.c. This is fixed in commit 8806c3ca007b84accac21dd88b900fb03614ceb7.
- Record
CVE-2020-24978- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-415
- Updated
- 2026-11-02
CVE List No score
In NASM 2.15.04rc3, there is a double-free vulnerability in pp_tokline asm/preproc.c. This is fixed in commit 8806c3ca007b84accac21dd88b900fb03614ceb7.
- Record
CVE-2020-24978- Updated
- 2026-11-02
EUVDEUVD-2020-17678 No score
In NASM 2.15.04rc3, there is a double-free vulnerability in pp_tokline asm/preproc.c. This is fixed in commit 8806c3ca007b84accac21dd88b900fb03614ceb7.
- Record
EUVD-2020-17678- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4vwx-p2g9-hr37
In NASM 2.15.04rc3, there is a double-free vulnerability in pp_tokline asm/preproc.c. This is...
In NASM 2.15.04rc3, there is a double-free vulnerability in pp_tokline asm/preproc.c. This is fixed in commit 8806c3ca007b84accac21dd88b900fb03614ceb7.
- Record
GHSA-4vwx-p2g9-hr37- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
OSV
In NASM 2.15.04rc3, there is a double-free vulnerability in pp_tokline asm/preproc.c. This is fixed in commit 8806c3ca007b84accac21dd88b900fb03614ceb7.
- Record
CVE-2020-24978- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-24978
In NASM 2.15.04rc3, there is a double-free vulnerability in pp_tokline asm/preproc.c. This is fixed in commit 8806c3ca007b84accac21dd88b900fb03614ceb7.
- Record
DEBIAN-CVE-2020-24978- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-24978
In NASM 2.15.04rc3, there is a double-free vulnerability in pp_tokline asm/preproc.c. This is fixed in commit 8806c3ca007b84accac21dd88b900fb03614ceb7.
- Record
UBUNTU-CVE-2020-24978- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nasmDebian:12 |
before 2.15.04-1 | 2.15.04-1 |
nasmDebian:13 |
before 2.15.04-1 | 2.15.04-1 |
nasmDebian:14 |
before 2.15.04-1 | 2.15.04-1 |
nasmUbuntu:16.04:LTS |
All versions, plus listed versions 2.11.06-1really2.11.05-12.11.08-12.11.08-1ubuntu0.1 |
None known |
nasmUbuntu:18.04:LTS |
All versions, plus listed versions 2.13.01-22.13.02-0.1 |
None known |
nasmUbuntu:20.04:LTS |
All versions, plus listed versions 2.14.02-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-24978 is a critical vulnerability (CVSS 9.8) in Nasm Netwide Assembler, published September 3, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.36%, the 71st percentile. Fixed in nasm 2.15.04-1.