CVE-2022-44370
NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake()...
NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
- Record
CVE-2022-44370- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
- Record
CVE-2022-44370- Updated
- 2026-11-02
EUVDEUVD-2022-47315 No score
NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
- Record
EUVD-2022-47315- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5hm2-2whx-4749
NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake()...
NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
- Record
GHSA-5hm2-2whx-4749- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVAZL-25934
CVE-2022-44370 affecting package nasm for versions less than 2.16-1
NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
- Record
AZL-25934- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2022-44370
- Record
BELL-CVE-2022-44370- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVJLSEC-2026-203
NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
- Record
JLSEC-2026-203- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2023-1245
nasm security update
NASM is the Netwide Assembler, a free portable assembler for the Intel 80x86 microprocessor series, using primarily the traditional Intel instruction mnemonics and syntax. It also provides tools in RDOFF binary format, includes linker, library manager, loader, and information dump.
Security Fix(es):
NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856(CVE-2022-44370)
- Record
OESA-2023-1245- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-44370
NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
- Record
UBUNTU-CVE-2022-44370- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV No score
NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
- Record
CVE-2022-44370- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-44370 No score
NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
- Record
DEBIAN-CVE-2022-44370- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nasmAzure Linux:2 |
before 2.16-1 | 2.16-1 |
nasmAlpaquita:23 |
2.15.05-r1 up to 2.16.01-r0 | 2.16.01-r0 |
nasmAlpaquita:stream |
2.15.05-r1 up to 2.16.01-r1 | 2.16.01-r1 |
nasmDebian:12 |
before 2.16.01-1 | 2.16.01-1 |
nasmDebian:13 |
before 2.16.01-1 | 2.16.01-1 |
nasmDebian:14 |
before 2.16.01-1 | 2.16.01-1 |
NASM_jllJulia |
before 2.16.1+0 | 2.16.1+0 |
nasmopenEuler:20.03-LTS-SP1 |
before 2.15.03-6.oe1 | 2.15.03-6.oe1 |
nasmopenEuler:20.03-LTS-SP3 |
before 2.15.03-6.oe1 | 2.15.03-6.oe1 |
nasmopenEuler:22.03-LTS |
before 2.15.05-5.oe2203sp1 | 2.15.05-5.oe2203sp1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nasmopenEuler:22.03-LTS-SP1 |
before 2.15.05-5.oe2203sp1 | 2.15.05-5.oe2203sp1 |
nasmUbuntu:16.04:LTS |
All versions, plus listed versions 2.11.06-1really2.11.05-12.11.08-12.11.08-1ubuntu0.1 |
None known |
nasmUbuntu:18.04:LTS |
All versions, plus listed versions 2.13.01-22.13.02-0.1 |
None known |
nasmUbuntu:20.04:LTS |
All versions, plus listed versions 2.14.02-1 |
None known |
nasmUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.15.05-12.15.05-1ubuntu0.1~esm12.15.05-1ubuntu0.1~esm2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-44370 is a high vulnerability (CVSS 7.8) in Nasm Netwide Assembler, published March 29, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 38th percentile. Fixed in nasm 2.16-1.