CVE-2023-29583: yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the function parse_expr5 at /nasm/nasm-parse.c. Note: This has been disputed by third parties who argue this is a bug and not a security issue because yasm is a standalone program not designed to run untrusted code.

CSIRTS triage

What: A stack overflow exists in the parse_expr5 function in the NASM parser component.
Who is affected: Users processing untrusted assembly source code with Yasm 1.3.0.55.g101bc are affected, though the vulnerability is disputed as yasm is a standalone assembler not designed for untrusted input.
Urgency: Medium severity with disputed classification; remediation depends on your assessment of untrusted input exposure in your environment.
Action: Update Yasm to a version with the stack overflow fixed, or restrict input to trusted sources if untrusted assembly code is unlikely in your use case.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Yasm

Get an email when a new Yasm advisory drops — max one per day, one-click unsubscribe.

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2023-295830.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.

CVE	CSIRTS overview	External
CVE-2023-29583	coverage & exploitation status	NVD · CVE.org