{"id":"CVE-2023-31722","aliases":["DEBIAN-CVE-2023-31722","EUVD-2023-36013","GHSA-8wfr-mc87-9vq6","OESA-2025-2623","UBUNTU-CVE-2023-31722","USN-8248-1"],"status":"published","title":"There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).","description":"There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00347,"percentile":0.28589,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2023-05-17T00:00:00Z","modified":"2026-10-28T02:31:02Z","fixes":[{"ecosystem":"openEuler:24.03-LTS-SP1","package":"nasm","fixed_in":["2.16.01-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"nasm","fixed_in":["2.16.01-2.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"nasm","fixed_in":["2.15.05-3.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"nasm","fixed_in":["2.15.05-8.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"nasm","fixed_in":["2.15.05-8.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"nasm","fixed_in":["2.16.01-2.oe2403"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nasm","fixed_in":["2.15.05-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"nasm","fixed_in":["2.16.01-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.01-1","2.16.03-1","3.01-1"]},{"source":"osv","ecosystem":"Debian:13","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.03-1","3.01-1"]},{"source":"osv","ecosystem":"Debian:14","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.03-1","3.01-1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.01-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.01-2.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.05-3.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.05-8.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.05-8.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.01-2.oe2403"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.05-1ubuntu0.1~esm1"}]}],"versions":["2.15.05-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.01-1ubuntu0.1~esm1"}]}],"versions":["2.16.01-1","2.16.01-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.03-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.15.05-1ubuntu0.1~esm1"}]}],"versions":["2.15.05-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"nasm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.16.01-1ubuntu0.1~esm1"}]}],"versions":["2.16.01-1","2.16.01-1build1"],"bundled":3}],"products":[{"vendor":"nasm","product":"netwide_assembler"}],"references":[{"url":"https://bugzilla.nasm.us/show_bug.cgi?id=3392857#c1","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31722","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8wfr-mc87-9vq6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31722.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-31722","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2623","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-31722","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-31722","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8248-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-33450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-33452","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-31722","description":"There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).","status":"published","published":"2023-05-17T00:00:00Z","modified":"2025-01-22T17:10:15.26Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:35:27.430605Z"}],"euvd":[{"id":"EUVD-2023-36013","description":"There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).","status":"published","published":"2023-05-17T00:00:00Z","modified":"2025-01-22T17:10:15Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:15.37855Z"}],"ghsa":[{"id":"GHSA-8wfr-mc87-9vq6","title":"There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).","description":"There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).","status":"published","published":"2023-05-17T15:30:20Z","modified":"2024-04-04T04:13:45Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:56:21.734223Z"}],"nvd":[{"id":"CVE-2023-31722","description":"There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).","status":"published","published":"2023-05-17T14:15:09.423Z","modified":"2026-06-17T05:57:25.207Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:08:02.399327Z"}],"osv":[{"id":"CVE-2023-31722","description":"There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).","status":"published","published":"2023-05-17T00:00:00Z","modified":"2026-10-28T02:31:02.820539084Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:31.790231Z"},{"id":"DEBIAN-CVE-2023-31722","description":"There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).","status":"published","published":"2023-05-17T14:15:09.423Z","modified":"2026-10-26T18:01:50.850209839Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"OESA-2025-2623","title":"nasm security update","description":"NASM is the Netwide Assembler, a free portable assembler for the Intel 80x86 microprocessor series, using primarily the traditional Intel instruction mnemonics and syntax. It also provides tools in RDOFF binary format, includes linker, library manager, loader, and information dump.\r\n\r\nSecurity Fix(es):\n\nThere exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).(CVE-2023-31722)","status":"published","published":"2025-11-07T11:09:44Z","modified":"2026-08-18T01:19:18.480162634Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"UBUNTU-CVE-2023-31722","description":"There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).","status":"published","published":"2023-05-17T14:15:00Z","modified":"2026-05-08T12:42:40.146325Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"USN-8248-1","title":"nasm vulnerabilities","description":"Daisy Chen discovered that NASM was vulnerable to a heap buffer overflow\nwhen handling certain input. An attacker could possibly use this issue\nto cause NASM to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2023-31722)\n\nIt was discovered that NASM incorrectly handled memory allocation.\nAn attacker could possibly use this issue to cause NASM to use\nexcessive resources, leading to a denial of service. This issue\nonly affected Ubuntu 24.04 LTS. (CVE-2021-33452, CVE-2021-33450)","status":"published","published":"2026-05-07T13:00:13Z","modified":"2026-05-11T10:46:46.739843Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}