Uninitialized Memory Vulnerability in pybddisasm Python Bindings

CVE-2026-118448

What is CVE-2026-118448?

The pybddisasm package has a vulnerability that occurs due to the use of uninitialized memory in its nd_to_text function. If the conversion process encounters errors due to invalid parameters, the output buffer may remain uninitialized. This leads to potentially exposing residual process memory or causing the Python process to crash. To exploit this vulnerability, an application must invoke the nd_to_text function in a manner that leads to conversion failure, resulting in unsafe memory usage. It's important to note that the pybddisasm package is no longer maintained, making it imperative for users to evaluate their reliance on this software.

References