Use-After-Free Vulnerability in pybddisasm Python Bindings Affects INSTRUX Objects

CVE-2026-118446

What is CVE-2026-118446?

The pybddisasm Python package contains a use-after-free vulnerability impacting INSTRUX objects, specifically affecting array-valued members such as ND_OPERAND arrays. These arrays are manipulated as Python lists, where their elements link to memory allocated for the parent INSTRUX object. Unfortunately, retaining the list or its elements does not preserve the memory allocation of the parent object. Consequently, accessing an element after the parent has been freed can lead to unpredictable outcomes including memory exposure or application crashes. Exploitation of this vulnerability hinges on retaining and accessing these array elements post-deallocation of the parent object. It's critical to note that the pybddisasm package is no longer actively maintained, highlighting the importance of addressing this issue promptly.

References