Out-of-Bounds Read Vulnerability in pybddisasm Python Bindings by PyPI

CVE-2026-118444

What is CVE-2026-118444?

The pybddisasm Python package contains an out-of-bounds read vulnerability that can lead to the disclosure of adjacent memory. Specifically, the nd_decode function reads up to 15 bytes without verifying the actual length of the user-provided buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions also do not properly validate the buffer size, allowing for potential exploitation when attackers use short buffers or oversized lengths. This flaw can expose sensitive information through the nd_get_instrux_bytes function, which retrieves a fixed-length list of 16 bytes. It's important to note that the pybddisasm package is no longer maintained, increasing the risk for users.

References