Use-After-Free Vulnerability in pybddisasm Python Bindings by PyBinaries

CVE-2026-118445

What is CVE-2026-118445?

The pybddisasm package contains a use-after-free vulnerability that compromises memory safety for applications utilizing its Python bindings. Specifically, structure-valued members of INSTRUX objects can be accessed after the associated parent object has been deallocated. This occurs because retained references to these members do not prolong the life of the parent object, leading to the potential for crashes or exposure of confidential process memory. Developers must be cautious, as exploitation relies on maintaining a reference to the member while accessing it post-deallocation, an act that could severely undermine application security. Note that the pybddisasm package is no longer actively maintained, further heightening the risks associated with this vulnerability.

References