{"id":"CVE-2026-118444","kind":"vulnerability","aliases":["CVE-2026-118444"],"related":[],"title":"pybddisasm: out-of-bounds read can leak adjacent process memory","description":"Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions pass the caller-supplied buffer size to the decoder without validating it against the actual length of the Python buffer. Data read beyond the buffer may be exposed through nd_get_instrux_bytes, which returns a fixed-length list of 16 bytes. Exploitation requires an application to invoke the affected APIs with a short buffer or an oversized length and to expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained.","summary":"The pybddisasm Python bindings for an x86 disassembler read past the end of a caller-supplied buffer during instruction decoding. An attacker who can feed input to an application using these functions and see the decoded output may recover nearby process memory.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["disassembler","package","pybddisasm","python"],"not_affected_if":["no-pybddisasm-installed","output-not-exposed"],"how_to_check":"- `pip show pybddisasm` to see whether the package is installed and at what version\n- Search the project for calls to `nd_decode`, `nd_decode_ex`, `nd_decode_ex2` or `nd_decode_with_context`\n- Check whether decoded bytes from `nd_get_instrux_bytes` are returned to untrusted users","fix":null,"status":"open","published_at":"2026-11-03T09:17:10+00:00","first_seen_at":"2026-11-03T09:19:50+00:00","triaged_at":"2026-11-03T09:20:31+00:00","updated_at":"2026-11-03T09:20:31+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T09:20:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"pybddisasm: out-of-bounds read can leak adjacent process memory","impact":"low","summary":"The pybddisasm Python bindings for an x86 disassembler read past the end of a caller-supplied buffer during instruction decoding. An attacker who can feed input to an application using these functions and see the decoded output may recover nearby process memory.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","pybddisasm","disassembler"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"adjacent process memory disclosed through decoded instruction bytes","analyst_note":"Confirm whether any fixed version exists; the package is unmaintained and the sources state no fix. Check the NVD entry for the affected version range.","how_to_check":"- `pip show pybddisasm` to see whether the package is installed and at what version\n- Search the project for calls to `nd_decode`, `nd_decode_ex`, `nd_decode_ex2` or `nd_decode_with_context`\n- Check whether decoded bytes from `nd_get_instrux_bytes` are returned to untrusted users","plain_action":"","needs_analyst":true,"not_affected_if":["no-pybddisasm-installed","output-not-exposed"],"who_is_affected":"Only applications that import pybddisasm and pass it short or oversized buffers, then return the resulting instruction bytes to a party outside the trust boundary. The package is no longer maintained, so no upstream fix is stated in the sources. Services that do not call these functions, or that never expose decoded output, are not exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000731,"input_tokens":4291,"output_tokens":603,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118444':14A,17A '-2026':13A,16A '15':92C '16':159C 'actual':97C,132C 'adjac':9A,78C 'affect':168C 'api':169C 'applic':51B,164C 'attack':44B,186C 'beyond':140C 'bind':25B,75C 'bound':5A,68C 'buffer':39B,103C,122C,137C,142C,173C 'byte':93C,150C,160C,183C 'caller':37B,120C 'caller-suppli':36B,119C 'check':95C 'context':115C 'cve':12A,15A 'data':138C 'decod':42B,58B,83C,86C,106C,109C,113C,126C 'disassembl':18B,29B 'disclos':77C 'end':33B 'ex':107C 'ex2':110C 'exploit':161C 'expos':145C,180C 'feed':47B 'fix':155C 'fixed-length':154C 'function':54B,87C,116C 'get':148C 'input':48B 'instruct':41B,82C 'instrux':149C 'invok':166C 'leak':8A 'length':98C,133C,156C,177C 'list':157C 'longer':192C 'maintain':193C 'may':60B,76C,88C,143C 'memori':11A,64B,80C 'nd':85C,105C,108C,112C,147C 'nearbi':62B 'out-of-bound':2A,65C 'output':59B 'overs':176C 'packag':19B,189C 'pass':117C 'past':31B 'process':10A,63B,79C 'pybddisasm':1A,20B,23B,73C,188C 'python':21B,24B,74C,102C,136C 'read':6A,30B,69C,89C,139C 'recov':61B 'requir':162C 'result':182C 'return':152C 'see':56B 'short':172C 'size':123C 'suppli':38B,101C,121C 'use':52B 'valid':128C 'vulner':70C 'without':94C,127C 'x86':28B","nicknames":[],"mitigations":[],"who_affected":"Only applications that import pybddisasm and pass it short or oversized buffers, then return the resulting instruction bytes to a party outside the trust boundary. The package is no longer maintained, so no upstream fix is stated in the sources. Services that do not call these functions, or that never expose decoded output, are not exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["disassembler","medium","package","pybddisasm","python"],"first_public_at":"2026-11-03T09:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-requests@bitdefender.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118444","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118444","severity":null,"published_at":"2026-11-03T09:17:10+00:00","modified_at":"2026-11-03T09:17:10+00:00","first_seen_at":"2026-11-03T09:19:50+00:00","fetched_at":"2026-11-03T09:19:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}