Security readout for executives and security teams
Plain-English summary
CVE-2021-33464 is a heap buffer overflow reported in Yasm 1.3.0. It affects the NASM preprocessor file-opening path. Business risk is most relevant where Yasm processes untrusted or externally supplied assembly input, especially in build, CI, or conversion workflows.
Executive priority
Prioritize as an exposure-mapping task unless Yasm processes untrusted input in production workflows. Escalate if external users can submit source files that are automatically built or preprocessed.
Technical view
The CVE describes a heap-buffer-overflow in inc_fopen() within modules/preprocs/nasm/nasm-pp.c in Yasm 1.3.0. The source bundle does not provide CVSS, CWE, affected CPEs, a fixed release, or vendor mitigation details.
Likely exposure
Exposure is most likely on developer machines, CI runners, build containers, or automated pipelines that invoke Yasm 1.3.0. Public-facing risk depends on whether untrusted users can supply files that Yasm preprocesses.
Exploitation context
The source bundle includes public references, but no KEV listing and no cited evidence of active exploitation. Treat any exploitability beyond malformed-input triggering as unconfirmed from the provided evidence.
Researcher notes
Evidence is sparse: the CVE identifies the function and file path, but lacks CVSS, CWE, fixed version, patch details, and confirmed exploitation. Validation should focus on actual Yasm invocation paths and trust boundaries.
Mitigation direction
- Inventory systems for Yasm 1.3.0 usage.
- Check upstream Yasm guidance and the linked issue for fixes or workarounds.
- Avoid processing untrusted assembly input with affected Yasm versions.
- Restrict CI/build jobs that accept external source artifacts.
- Replace or upgrade Yasm only when vendor guidance confirms a safe target.
Validation and detection
- Check build hosts, CI runners, and containers for Yasm 1.3.0.
- Review pipelines for jobs invoking Yasm or the NASM preprocessor.
- Confirm whether user-supplied files can reach Yasm processing.
- Review security monitoring for crashes in Yasm-related build jobs.
- Track the linked GitHub issue for resolution status.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-33464 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/yasm/yasm/issues/164CVE reference · x_refsource_MISC
- https://gist.github.com/Clingto/bb632c0c463f4b2c97e4f65f751c5e6dCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.