Vulnerability · Published Aug 11, 2025 · Assigned by VulDB
CVE-2025-8842NASM Netwide Assember preproc.c do_directive use after free
Medium 5.3
In plain English
A medium-severity use-after-free in Netwide Assember from NASM. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 83.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability has been found in NASM Netwide Assember 2.17rc0. Affected by this issue is the function do_directive of the file preproc.c. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | nasm | no fix listed | DEBIAN-CVE-2025-8842 |
| Debian:13 | nasm | no fix listed | DEBIAN-CVE-2025-8842 |
| Debian:14 | nasm | no fix listed | DEBIAN-CVE-2025-8842 |
| Ubuntu:25.10 | nasm | no fix listed | UBUNTU-CVE-2025-8842 |
| Ubuntu:26.04:LTS | nasm | no fix listed | UBUNTU-CVE-2025-8842 |
| Ubuntu:26.10 | nasm | no fix listed | UBUNTU-CVE-2025-8842 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NASM | Netwide Assember | 2.17rc0 |
Weakness: CWE-416, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-319376 | NASM Netwide Assember preproc.c do_directive use after free vdb-entry, technical-description
- VDB-319376 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #623184 | nasm NASM version 2.17rc0 compiled on Jul 20 2025 and the newest master (888d9ab) Memory Corruption third-party-advisory
- https://bugzilla.nasm.us/show_bug.cgi?id=3392933 issue-tracking
- https://drive.google.com/file/d/11vEV1vMHXO4BrDGhvWAMm0Qo1woiUwVV/view?usp=drive_link exploit