CVE-2021-33450
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in...
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c.
- Record
CVE-2021-33450- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c.
- Record
CVE-2021-33450- Updated
- 2026-11-02
EUVDEUVD-2021-20154 No score
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c.
- Record
EUVD-2021-20154- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jp9m-h4rc-45p2
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in...
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c.
- Record
GHSA-jp9m-h4rc-45p2- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-401
- Updated
- 2026-11-02
OSVAZL-41338
CVE-2021-33450 affecting package nasm 2.16.01-2
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c.
- Record
AZL-41338- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
OSV
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c.
- Record
CVE-2021-33450- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2021-33450
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c.
- Record
DEBIAN-CVE-2021-33450- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-33450
An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c.
- Record
UBUNTU-CVE-2021-33450- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-8248-1 No score
nasm vulnerabilities
Daisy Chen discovered that NASM was vulnerable to a heap buffer overflow when handling certain input. An attacker could possibly use this issue to cause NASM to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2023-31722)
It was discovered that NASM incorrectly handled memory allocation. An attacker could possibly use this issue to cause NASM to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2021-33452, CVE-2021-33450)
- Record
USN-8248-1- Updated
- 2026-11-02
OSVUSN-8248-2 No score
nasm regression
USN-8248-1 fixed vulnerabilities in NASM. Unfortunately the update introduced a regression which could cause NASM to crash. This update fixes the problem by reverting the fix for CVE-2021-33450 and CVE-2021-33452 in Ubuntu 24.04 LTS.
We apologize for the inconvenience.
Original advisory details:
Daisy Chen discovered that NASM was vulnerable to a heap buffer overflow when handling certain input. An attacker could possibly use this issue to cause NASM to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2023-31722)
It was discovered that NASM incorrectly handled memory allocation. An attacker could possibly use this issue to cause NASM to use excessive resources, leading to a denial of service. This issue only affected Ubuntu 24.04 LTS. (CVE-2021-33452, CVE-2021-33450)
- Record
USN-8248-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nasmAzure Linux:3 |
through 2.16.01-2 | None known |
nasmDebian:12 |
All versions, plus listed versions 2.16.01-12.16.03-13.01-1 |
None known |
nasmDebian:13 |
All versions, plus listed versions 2.16.03-13.01-1 |
None known |
nasmDebian:14 |
All versions, plus listed versions 2.16.03-13.01-1 |
None known |
nasmUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.16.01-12.16.01-1build12.16.01-1ubuntu0.1~esm12.16.01-1ubuntu0.1~esm2 |
None known |
nasmUbuntu:25.10 |
All versions, plus listed versions 2.16.03-1 |
None known |
nasmUbuntu:Pro:22.04:LTS From an advisory covering 3 CVEs |
before 2.15.05-1ubuntu0.1~esm1, plus listed versions 2.15.05-1 |
2.15.05-1ubuntu0.1~esm1 |
nasmUbuntu:Pro:24.04:LTS From an advisory covering 3 CVEs |
before 2.16.01-1ubuntu0.1~esm1, plus listed versions 2.16.01-12.16.01-1build1 |
2.16.01-1ubuntu0.1~esm1 |
nasmUbuntu:Pro:24.04:LTS From an advisory covering 2 CVEs |
before 2.16.01-1ubuntu0.1~esm2, plus listed versions 2.16.01-12.16.01-1build12.16.01-1ubuntu0.1~esm1 |
2.16.01-1ubuntu0.1~esm2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-33450 is a medium vulnerability (CVSS 5.5) in Nasm Netwide Assembler, published July 26, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. No source names a fixed version.