LiveActive security incident?Get immediate response
CVE Record

CVE-2021-33463: An issue was discovered in yasm version 1.3.0.

An issue was discovered in yasm version 1.3.0. There is a NULL pointer dereference in yasm_expr__copy_except() in libyasm/expr.c.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2021-33463 is a crash issue in Yasm 1.3.0. A flaw in expression-copying code can dereference a NULL pointer, which typically means the assembler process can terminate unexpectedly when handling certain input. The public record does not provide CVSS, affected downstream products, a patch, or evidence of active exploitation.

Executive priority

Prioritize based on whether Yasm is exposed to untrusted inputs. For most organizations this is likely a limited availability issue in build or analysis tooling, not an internet-facing emergency. Treat it as higher priority if public upload, malware analysis, or automated build services invoke Yasm.

Technical view

The CVE identifies a NULL pointer dereference in yasm_expr__copy_except() in libyasm/expr.c in Yasm 1.3.0. Available sources describe the vulnerable location but do not provide a CWE, CVSS vector, exploit status, or remediation version. Treat the impact as availability risk for workflows that invoke Yasm on attacker-controlled input.

Likely exposure

Exposure is most likely in developer workstations, build systems, CI jobs, package pipelines, or analysis services that use Yasm 1.3.0. Risk is higher where Yasm processes externally supplied assembly or source inputs. The source bundle does not identify affected operating system packages or downstream products.

Exploitation context

The provided sources reference a GitHub issue and proof-of-concept material, but KEV is false and no source states active exploitation. The known behavior is a NULL pointer dereference, so the practical concern is process crash or pipeline disruption rather than confirmed code execution.

Researcher notes

Evidence is sparse: the CVE names the vulnerable function and version, but no CVSS, CWE, affected package list, or fixed release is included. Do not assume broader affected versions. Validation should focus on confirming Yasm 1.3.0 presence and whether input sources are attacker-controlled.

Mitigation direction

  • Inventory systems and containers for Yasm 1.3.0 usage.
  • Check upstream Yasm issue and distribution advisories for fixed packages or guidance.
  • Avoid processing untrusted input with Yasm until remediation is confirmed.
  • Sandbox CI or analysis jobs that must run Yasm on external files.
  • Monitor build failures that could indicate repeated parser crashes.

Validation and detection

  • Confirm installed Yasm versions on developer, CI, and build hosts.
  • Identify workflows where Yasm handles external or user-submitted inputs.
  • Review dependency images and package manifests for bundled Yasm 1.3.0.
  • Verify whether upstream or distribution packages document a fix.
  • Record compensating controls for any unavoidable Yasm 1.3.0 use.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-33463 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.