Heap Use After Free Vulnerabilities in Netwide Assembler by NASM

CVE-2017-10686

What is CVE-2017-10686?

In Netwide Assembler (NASM) version 2.14rc0, multiple heap use after free vulnerabilities can be exploited. The vulnerabilities arise from the way memory is managed in the tool, particularly within the token() and detoken() functions. When heap memory allocated in token() is improperly freed in detoken(), there are risks of corrupted double-linked lists, double free or corruption scenarios, and out-of-bounds writes. These vulnerabilities heighten the potential for remote code execution attacks, posing significant security risks.

References