Medium
Security advisory
asm/labels.c in Netwide Assembler (NASM) is prone to NULL Pointer Dereference, which allows the attacker to cause a denial of service via a crafted file.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-16517
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:19 UTC · Revision 1
Source evidence
asm/labels.c in Netwide Assembler (NASM) is prone to NULL Pointer Dereference, which allows the attacker to cause a denial of service via a crafted file.
osv:CVE-2018-16517
Complete source record
{
"id": "fb5277797ef9034b54cfaa9c7902c1bcd4e27a51f4edee7cfdf69154df361e2f",
"url": "https://osv.dev/vulnerability/CVE-2018-16517",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2018-16517",
"summary": "asm/labels.c in Netwide Assembler (NASM) is prone to NULL Pointer Dereference, which allows the attacker to cause a denial of service via a crafted file.",
"evidence": "osv:CVE-2018-16517",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2018-16517",
"aliases": [
"CVE-2018-16517"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/netwide-assembler/nasm",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "ef7d18bfbb899fe8e44f4fae8d6a12e2742f69f5"
},
{
"introduced": "ccd2d5c542c27c53f8dd547c817303845c7ca6dc"
},
{
"last_affected": "ccd2d5c542c27c53f8dd547c817303845c7ca6dc"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:nasm:netwide_assembler:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.13.03"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:nasm:netwide_assembler:2.14:rc15:*:*:*:*:*:*",
"range": [
{
"introduced": "2.14-rc15"
},
{
"last_affected": "2.14-rc15"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"2.14-rc15",
"nasm-2.14rc15",
"nasm-2.13.03",
"nasm-2.13.03rc6",
"nasm-2.13.03rc5",
"nasm-2.13.03rc3",
"nasm-2.13.03.rc2",
"nasm-2.13.03rc1",
"nasm-2.13.02",
"nasm-2.13.02rc3",
"nasm-2.13.02rc2",
"nasm-2.13.02rc1",
"nasm-2.13.01",
"nasm-2.13",
"nasm-2.13rc23",
"nasm-2.13rc22",
"nasm-2.13rc21",
"nasm-2.13rc18",
"nasm-2.13rc17",
"nasm-2.13rc16",
"nasm-2.13rc15",
"nasm-2.13rc14",
"nasm-2.13rc13",
"nasm-2.13rc12",
"nasm-2.13rc11",
"nasm-2.13rc10",
"nasm-2.13rc9",
"nasm-2.13rc8",
"nasm-2.13rc7",
"nasm-2.13rc6",
"nasm-2.13rc5",
"nasm-2.13rc4",
"nasm-2.13rc3",
"nasm-2.13rc2",
"nasm-2.13rc1",
"nasm-2.12rc3",
"nasm-2.12rc2",
"nasm-2.12rc1",
"nasm-2.11.09rc2",
"nasm-2.11.09rc1",
"nasm-2.11.08",
"nasm-2.11.07",
"nasm-2.11.06",
"nasm-2.11.03",
"nasm-2.11.02",
"nasm-2.11.01",
"nasm-2.11",
"nasm-2.11rc4",
"nasm-2.11rc3",
"nasm-2.11rc2",
"nasm-2.11rc1",
"nasm-2.10.09",
"nasm-2.10.08",
"nasm-2.10.07",
"nasm-2.10.06",
"nasm-2.10.05",
"nasm-2.10.04",
"nasm-2.10.03",
"nasm-2.10.02",
"nasm-2.10.01",
"nasm-2.10",
"nasm-2.10rc15",
"nasm-2.10rc14",
"nasm-2.10rc13",
"nasm-2.10rc12",
"nasm-2.10rc11",
"nasm-2.10rc10",
"nasm-2.10rc9",
"nasm-2.10rc8",
"nasm-2.10rc7",
"verified",
"nasm-2.10rc6",
"nasm-2.10rc5",
"nasm-2.10rc4",
"nasm-2.10rc3",
"nasm-2.10rc2",
"nasm-2.10rc1",
"nasm-2.09",
"nasm-2.09rc7",
"nasm-2.09rc6",
"nasm-2.09rc5",
"nasm-2.09rc4",
"nasm-2.09rc2",
"nasm-2.09rc1",
"nasm-2.08",
"nasm-2.08rc10",
"nasm-2.08rc9",
"nasm-2.08rc8",
"nasm-2.08rc7",
"nasm-2.08rc6",
"nasm-2.08rc5",
"nasm-2.08rc4",
"nasm-2.08rc3",
"nasm-2.08rc2",
"nasm-2.08rc1",
"nasm-2.07",
"nasm-2.07rc7",
"nasm-2.07rc6",
"nasm-2.07rc5",
"nasm-2.07rc4",
"nasm-2.07rc3",
"nasm-2.07rc2",
"nasm-2.07rc1",
"nasm-2.06.01rc1",
"nasm-2.06",
"nasm-2.06rc16",
"nasm-2.06rc15",
"nasm-2.06rc14",
"nasm-2.06rc13",
"nasm-2.06rc12",
"nasm-2.06rc11",
"nasm-2.06rc10",
"nasm-2.06rc9",
"nasm-2.06rc8",
"nasm-2.06rc7",
"nasm-2.06rc6",
"nasm-2.06rc5",
"nasm-2.06rc4",
"nasm-2.06rc3",
"nasm-2.06rc2",
"nasm-2.06rc1",
"nasm-2.05",
"nasm-2.05rc8",
"nasm-2.05rc7",
"nasm-2.05rc6",
"nasm-2.05rc5",
"nasm-2.05rc4",
"nasm-2.05rc3",
"nasm-2.05rc2",
"nasm-2.05rc1",
"nasm-2.04",
"nasm-2.04rc6",
"nasm-2.04rc5",
"nasm-2.04rc4",
"nasm-2.04rc3",
"nasm-2.04rc2",
"nasm-2.04rc1",
"nasm-2.03rc8",
"nasm-2.03rc7",
"nasm-2.03rc5",
"nasm-2.03rc6",
"nasm-2.03rc3",
"nasm-2.03rc2",
"nasm-2.03rc1",
"nasm-2.02",
"nasm-2.02rc2",
"nasm-2.02rc1",
"nasm-2.01",
"nasm-2.01rc2",
"nasm-2.01rc1",
"nasm-2.00",
"nasm-2.00rc3",
"nasm-2.00rc1",
"nasm-0.99.06",
"nasm-0.99.05",
"nasm-0.99.02",
"nasm-0.99.01",
"nasm-0.98.39",
"before-reformat-2005-01",
"nasm-0.98.38",
"nasm-0.98.37",
"nasm-0.98.36",
"nasm-0.98.35",
"nasm-0.98.34",
"nasm-0.98.33",
"nasm-0.98.32",
"nasm-0.98.31",
"nasm-0.98.30",
"nasm-0.98.26",
"nasm-0.98.25alt",
"nasm-0.98.25",
"nasm-0.98.24",
"nasm-0.98.23",
"nasm-0.98.22",
"nasm-0.98.21",
"nasm-0.98.20",
"nasm-0.98.19",
"nasm-0.98.18",
"nasm-0.98.17",
"nasm-0.98.16",
"fork-0.98e",
"nasm-0.98.15",
"nasm-0.98.14",
"nasm-0.98.12",
"nasm-0.98.11",
"nasm-0.98.09",
"nasm-0.98.08",
"nasm-0.98.03",
"nasm-0.98",
"fork-0.98bf",
"nasm-0.98p7",
"nasm-0.98p6",
"nasm-0.98p3.7",
"nasm-0.98p3.6",
"nasm-0.98p3.5",
"nasm-0.98p3.4",
"nasm-0.98p3.3",
"fork-0.98-j5",
"nasm-0.98p3.2",
"nasm-0.98p3-hpa",
"nasm-0.98p3",
"nasm-0.97",
"fork-0.98-j",
"nasm-0.96",
"nasm-0.95",
"nasm-0.94",
"nasm-0.93",
"nasm-0.91"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-16517.json"
}
}
],
"modified": "2026-10-24T10:31:05.981248005Z",
"provider": "osv",
"references": [
"https://bugzilla.nasm.us/show_bug.cgi?id=3392513",
"https://fakhrizulkifli.github.io/CVE-2018-16517.html",
"https://www.exploit-db.com/exploits/46726/"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:nasm:netwide_assembler:2.14.0:rc10:*:*:*:*:*:*",
"cpe:2.3:a:nasm:netwide_assembler:2.14.0:rc11:*:*:*:*:*:*",
"cpe:2.3:a:nasm:netwide_assembler:2.14.0:rc12:*:*:*:*:*:*",
"cpe:2.3:a:nasm:netwide_assembler:2.14.0:rc13:*:*:*:*:*:*",
"cpe:2.3:a:nasm:netwide_assembler:2.14.0:rc14:*:*:*:*:*:*",
"cpe:2.3:a:nasm:netwide_assembler:2.14.0:rc1:*:*:*:*:*:*",
"cpe:2.3:a:nasm:netwide_assembler:2.14.0:rc2:*:*:*:*:*:*",
"cpe:2.3:a:nasm:netwide_assembler:2.14.0:rc3:*:*:*:*:*:*",
"cpe:2.3:a:nasm:netwide_assembler:2.14.0:rc4:*:*:*:*:*:*",
"cpe:2.3:a:nasm:netwide_assembler:2.14.0:rc5:*:*:*:*:*:*",
"cpe:2.3:a:nasm:netwide_assembler:2.14.0:rc6:*:*:*:*:*:*",
"cpe:2.3:a:nasm:netwide_assembler:2.14.0:rc7:*:*:*:*:*:*",
"cpe:2.3:a:nasm:netwide_assembler:2.14.0:rc8:*:*:*:*:*:*",
"cpe:2.3:a:nasm:netwide_assembler:2.14.0:rc9:*:*:*:*:*:*"
],
"vendor_product": "nasm:netwide_assembler",
"extracted_events": [
{
"range": [
{
"introduced": "2.14.0-rc1"
},
{
"last_affected": "2.14.0-rc1"
},
{
"introduced": "2.14.0-rc10"
},
{
"last_affected": "2.14.0-rc10"
},
{
"introduced": "2.14.0-rc11"
},
{
"last_affected": "2.14.0-rc11"
},
{
"introduced": "2.14.0-rc12"
},
{
"last_affected": "2.14.0-rc12"
},
{
"introduced": "2.14.0-rc13"
},
{
"last_affected": "2.14.0-rc13"
},
{
"introduced": "2.14.0-rc14"
},
{
"last_affected": "2.14.0-rc14"
},
{
"introduced": "2.14.0-rc2"
},
{
"last_affected": "2.14.0-rc2"
},
{
"introduced": "2.14.0-rc3"
},
{
"last_affected": "2.14.0-rc3"
},
{
"introduced": "2.14.0-rc4"
},
{
"last_affected": "2.14.0-rc4"
},
{
"introduced": "2.14.0-rc5"
},
{
"last_affected": "2.14.0-rc5"
},
{
"introduced": "2.14.0-rc6"
},
{
"last_affected": "2.14.0-rc6"
},
{
"introduced": "2.14.0-rc7"
},
{
"last_affected": "2.14.0-rc7"
},
{
"introduced": "2.14.0-rc8"
},
{
"last_affected": "2.14.0-rc8"
},
{
"introduced": "2.14.0-rc9"
},
{
"last_affected": "2.14.0-rc9"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2018-16517",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 440881,
"published_at": "2018-09-06T23:29:01.46+00:00"
}