Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-33450: NASM memory leak can cause high memory usage

CVE-2021-33450 · published 4 years ago

Summary

The NASM assembler (versions around 2.16rc0) does not release memory properly, so it can gradually consume more RAM. This can slow down servers or cause applications that use NASM to run out of memory. Upgrade to a newer NASM release or apply the available patch to fix the leak.

What to do

Update canonical nasm to version 2.16.01-1ubuntu0.1~esm1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:Pro:24.04:LTS	canonical	nasm	< 2.16.01-1ubuntu0.1~esm1 Fix: upgrade to 2.16.01-1ubuntu0.1~esm1
Ubuntu:25.10	canonical	nasm	All versions
Debian:12	debian	nasm	All versions
Debian:13	debian	nasm	All versions
Debian:14	debian	nasm	All versions
–	nasm	netwide_assembler	2.16 `cpe:2.3:a:nasm:netwide_assembler:2.16:rc0::::::`

Original advisory text

An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_calloc() in nasmlib/alloc.c.

References

https://ubuntu.com/security/CVE-2021-33450 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2021-33450 Third Party Advisory
https://ubuntu.com/security/notices/USN-8248-1 Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2021-33450 Vendor Advisory
https://bugzilla.nasm.us/show_bug.cgi?id=3392758 Exploit Issue Tracking Third Party Advisory
https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6d Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-401Memory Leak

Timeline

Published26 Jul 2022

Updated4 Nov 2026

First seen8 May 2026

Sources

UBUNTU-CVE-2021-33450 · OSV

CVE-2021-33450 · NVD

DEBIAN-CVE-2021-33450 · OSV

Track software like this

Free during beta