Medium
Security advisory
A stack-use-after-scope issue discovered in expand_mmac_params function in preproc.c in nasm before 2.15.04 allows remote attackers to cause a denial of service via crafted asm file.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-21686
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:09 UTC · Revision 1
Source evidence
A stack-use-after-scope issue discovered in expand_mmac_params function in preproc.c in nasm before 2.15.04 allows remote attackers to cause a denial of service via crafted asm file.
osv:CVE-2020-21686
Complete source record
{
"id": "1ac91738f47864e875a038e203867a2d8fe17a08b7e9b020b77bb22a24d5a6fb",
"url": "https://osv.dev/vulnerability/CVE-2020-21686",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-21686",
"summary": "A stack-use-after-scope issue discovered in expand_mmac_params function in preproc.c in nasm before 2.15.04 allows remote attackers to cause a denial of service via crafted asm file.",
"evidence": "osv:CVE-2020-21686",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-21686",
"aliases": [
"CVE-2020-21686"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/netwide-assembler/nasm",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "717348304378b9148e3e87d41bf54f67d36dee72"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:nasm:netwide_assembler:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.15.04"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"nasm-2.15.04rc6",
"nasm-2.15.04rc5",
"nasm-2.15.04rc4",
"nasm-2.15.04rc3",
"nasm-2.15.04rc2",
"nasm-2.15.04rc1",
"nasm-2.15.03",
"nasm-2.15.03rc8",
"nasm-2.15.03rc7",
"nasm-2.15.03rc6",
"nasm-2.15.03rc5",
"nasm-2.15.03rc4",
"nasm-2.15.03rc3",
"nasm-2.15.03rc2",
"nasm-2.15.03rc1",
"nasm-2.15.02",
"nasm-2.15.02rc2",
"nasm-2.15.02rc1",
"nasm-2.15.01",
"nasm-2.15",
"nasm-2.15rc12",
"nasm-2.15rc11",
"nasm-2.15rc10",
"nasm-2.15rc9",
"nasm-2.15rc8",
"nasm-2.15rc7",
"nasm-2.15rc6",
"nasm-2.15rc5",
"nasm-2.15rc4",
"nasm-2.15rc3",
"nasm-2.15rc2",
"nasm-2.15rc1",
"nasm-2.14rc3",
"nasm-2.14rc2",
"nasm-2.14rc1",
"nasm-2.13",
"nasm-2.13rc23",
"nasm-2.13rc22",
"nasm-2.13rc21",
"nasm-2.13rc18",
"nasm-2.13rc17",
"nasm-2.13rc16",
"nasm-2.13rc15",
"nasm-2.13rc14",
"nasm-2.13rc13",
"nasm-2.13rc12",
"nasm-2.13rc11",
"nasm-2.13rc10",
"nasm-2.13rc9",
"nasm-2.13rc8",
"nasm-2.13rc7",
"nasm-2.13rc6",
"nasm-2.13rc5",
"nasm-2.13rc4",
"nasm-2.13rc3",
"nasm-2.13rc2",
"nasm-2.13rc1",
"nasm-2.12rc3",
"nasm-2.12rc2",
"nasm-2.12rc1",
"nasm-2.11.09rc2",
"nasm-2.11.09rc1",
"nasm-2.11.08",
"nasm-2.11.07",
"nasm-2.11.06",
"nasm-2.11.03",
"nasm-2.11.02",
"nasm-2.11.01",
"nasm-2.11",
"nasm-2.11rc4",
"nasm-2.11rc3",
"nasm-2.11rc2",
"nasm-2.11rc1",
"nasm-2.10.09",
"nasm-2.10.08",
"nasm-2.10.07",
"nasm-2.10.06",
"nasm-2.10.05",
"nasm-2.10.04",
"nasm-2.10.03",
"nasm-2.10.02",
"nasm-2.10.01",
"nasm-2.10",
"nasm-2.10rc15",
"nasm-2.10rc14",
"nasm-2.10rc13",
"nasm-2.10rc12",
"nasm-2.10rc11",
"nasm-2.10rc10",
"nasm-2.10rc9",
"nasm-2.10rc8",
"nasm-2.10rc7",
"verified",
"nasm-2.10rc6",
"nasm-2.10rc5",
"nasm-2.10rc4",
"nasm-2.10rc3",
"nasm-2.10rc2",
"nasm-2.10rc1",
"nasm-2.09",
"nasm-2.09rc7",
"nasm-2.09rc6",
"nasm-2.09rc5",
"nasm-2.09rc4",
"nasm-2.09rc2",
"nasm-2.09rc1",
"nasm-2.08",
"nasm-2.08rc10",
"nasm-2.08rc9",
"nasm-2.08rc8",
"nasm-2.08rc7",
"nasm-2.08rc6",
"nasm-2.08rc5",
"nasm-2.08rc4",
"nasm-2.08rc3",
"nasm-2.08rc2",
"nasm-2.08rc1",
"nasm-2.07",
"nasm-2.07rc7",
"nasm-2.07rc6",
"nasm-2.07rc5",
"nasm-2.07rc4",
"nasm-2.07rc3",
"nasm-2.07rc2",
"nasm-2.07rc1",
"nasm-2.06.01rc1",
"nasm-2.06",
"nasm-2.06rc16",
"nasm-2.06rc15",
"nasm-2.06rc14",
"nasm-2.06rc13",
"nasm-2.06rc12",
"nasm-2.06rc11",
"nasm-2.06rc10",
"nasm-2.06rc9",
"nasm-2.06rc8",
"nasm-2.06rc7",
"nasm-2.06rc6",
"nasm-2.06rc5",
"nasm-2.06rc4",
"nasm-2.06rc3",
"nasm-2.06rc2",
"nasm-2.06rc1",
"nasm-2.05",
"nasm-2.05rc8",
"nasm-2.05rc7",
"nasm-2.05rc6",
"nasm-2.05rc5",
"nasm-2.05rc4",
"nasm-2.05rc3",
"nasm-2.05rc2",
"nasm-2.05rc1",
"nasm-2.04",
"nasm-2.04rc6",
"nasm-2.04rc5",
"nasm-2.04rc4",
"nasm-2.04rc3",
"nasm-2.04rc2",
"nasm-2.04rc1",
"nasm-2.03rc8",
"nasm-2.03rc7",
"nasm-2.03rc5",
"nasm-2.03rc6",
"nasm-2.03rc3",
"nasm-2.03rc2",
"nasm-2.03rc1",
"nasm-2.02",
"nasm-2.02rc2",
"nasm-2.02rc1",
"nasm-2.01",
"nasm-2.01rc2",
"nasm-2.01rc1",
"nasm-2.00",
"nasm-2.00rc3",
"nasm-2.00rc1",
"nasm-0.99.06",
"nasm-0.99.05",
"nasm-0.99.02",
"nasm-0.99.01",
"nasm-0.98.39",
"before-reformat-2005-01",
"nasm-0.98.38",
"nasm-0.98.37",
"nasm-0.98.36",
"nasm-0.98.35",
"nasm-0.98.34",
"nasm-0.98.33",
"nasm-0.98.32",
"nasm-0.98.31",
"nasm-0.98.30",
"nasm-0.98.26",
"nasm-0.98.25alt",
"nasm-0.98.25",
"nasm-0.98.24",
"nasm-0.98.23",
"nasm-0.98.22",
"nasm-0.98.21",
"nasm-0.98.20",
"nasm-0.98.19",
"nasm-0.98.18",
"nasm-0.98.17",
"nasm-0.98.16",
"fork-0.98e",
"nasm-0.98.15",
"nasm-0.98.14",
"nasm-0.98.12",
"nasm-0.98.11",
"nasm-0.98.09",
"nasm-0.98.08",
"nasm-0.98.03",
"nasm-0.98",
"fork-0.98bf",
"nasm-0.98p7",
"nasm-0.98p6",
"nasm-0.98p3.7",
"nasm-0.98p3.6",
"nasm-0.98p3.5",
"nasm-0.98p3.4",
"nasm-0.98p3.3",
"fork-0.98-j5",
"nasm-0.98p3.2",
"nasm-0.98p3-hpa",
"nasm-0.98p3",
"nasm-0.97",
"fork-0.98-j",
"nasm-0.96",
"nasm-0.95",
"nasm-0.94",
"nasm-0.93",
"nasm-0.91"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-21686.json"
}
}
],
"modified": "2026-10-24T10:30:49.466061210Z",
"provider": "osv",
"references": [
"https://bugzilla.nasm.us/show_bug.cgi?id=3392643"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-21686",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 437000,
"published_at": "2023-08-22T19:16:14.327+00:00"
}