LiveActive security incident?Get immediate response
CVE Record

CVE-2021-34123: An issue was discovered on atasm, version 1.09.

An issue was discovered on atasm, version 1.09. A stack-buffer-overflow vulnerability in function aprintf() in asm.c allows attackers to execute arbitrary code on the system via a crafted file.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2021-34123 is a reported stack buffer overflow in atasm 1.09. A maliciously crafted input file may let an attacker run code on the system running the tool. Exposure appears limited to environments that use this assembler, especially with files from untrusted sources.

Executive priority

Handle as a targeted exposure review rather than a broad emergency. If atasm 1.09 is used in build or research workflows, prioritize containment because the reported impact is code execution from a crafted file.

Technical view

The CVE describes a stack-buffer-overflow in aprintf() in asm.c in atasm 1.09. The reported impact is arbitrary code execution via a crafted file. The source bundle does not provide CVSS, CWE classification, affected CPEs, exploit details, or a named fixed version.

Likely exposure

Most organizations are unlikely to be exposed unless atasm 1.09 is present in build systems, developer workstations, tooling containers, or archival compilation workflows. Risk increases if users process third-party or externally supplied assembly files.

Exploitation context

The CVE is not listed as CISA KEV in the provided bundle. The sources cite a public SourceForge bug report, but do not establish active exploitation, weaponized exploit availability, or exploitation in the wild.

Researcher notes

Evidence is sparse. The available records identify atasm 1.09, aprintf() in asm.c, stack buffer overflow, and crafted-file code execution. They do not provide scoring, patch status, exploit maturity, or detailed product metadata.

Mitigation direction

  • Inventory build systems, developer workstations, and containers for atasm 1.09.
  • Do not process untrusted assembly files with atasm until vendor guidance is confirmed.
  • Run atasm only in isolated, least-privilege environments if business use must continue.
  • Check the project or vendor guidance for a fixed version or recommended workaround.
  • Retire or replace atasm where no maintained safe version is available.

Validation and detection

  • Search software inventories and build scripts for atasm usage.
  • Verify installed atasm versions where the tool is found.
  • Identify workflows that accept third-party or externally supplied assembly files.
  • Confirm sandboxing, least privilege, and file-source controls around any remaining usage.
  • Track the CVE record and SourceForge issue for remediation updates.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-34123 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.