High severity · published Aug 11, 2025
CVE-2025-8842
NASM Netwide Assember preproc.c do_directive use after free
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability has been found in NASM Netwide Assember 2.17rc0. Affected by this issue is the function do_directive of the file preproc.c. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
Netwide Assember · NASM
2.17rc0 · source: vendor
NA
Netwide Assembler · Nasm
2.17 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8842
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8842
Exploit
https://bugzilla.nasm.us/show_bug.cgi?id=3392933
Exploit
https://drive.google.com/file/d/11vEV1vMHXO4BrDGhvWAMm0Qo1woiUwVV/view?usp=drive_link
Permissions Required
https://vuldb.com/?ctiid.319376
Third Party Advisory
https://vuldb.com/?id.319376
Exploit
https://vuldb.com/?submit.623184
More from Netwide Assember
7.8
CVE-2025-8846
NASM Netwide Assember parser.c parse_line stack-based overflow
7.8
CVE-2025-8845
NASM Netwide Assember nasm.c assemble_file stack-based overflow
7.8
CVE-2025-8843
NASM Netwide Assember outmacho.c macho_no_dead_strip heap-based overflow
5.5
CVE-2025-8844
NASM Netwide Assember preproc.c parse_smacro_template null pointer dereference