---
id: "CVE-2026-118444"
kind: "vulnerability"
aliases: ["CVE-2026-118444"]
title: "pybddisasm: out-of-bounds read can leak adjacent process memory"
severity: "medium"
cvss: 4.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["disassembler", "package", "pybddisasm", "python"]
not_affected_if: ["no-pybddisasm-installed", "output-not-exposed"]
published_at: "2026-11-03T09:17:10+00:00"
first_seen_at: "2026-11-03T09:19:50+00:00"
updated_at: "2026-11-03T09:20:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118444", "first_seen_at": "2026-11-03T09:19:50+00:00"}]
---

# pybddisasm: out-of-bounds read can leak adjacent process memory

The pybddisasm Python bindings for an x86 disassembler read past the end of a caller-supplied buffer during instruction decoding. An attacker who can feed input to an application using these functions and see the decoded output may recover nearby process memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `pip show pybddisasm` to see whether the package is installed and at what version
- Search the project for calls to `nd_decode`, `nd_decode_ex`, `nd_decode_ex2` or `nd_decode_with_context`
- Check whether decoded bytes from `nd_get_instrux_bytes` are returned to untrusted users

## Timeline

- 2026-11-03T09:19:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118444

## From the sources

Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nd_decode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nd_decode_ex, nd_decode_ex2, and nd_decode_with_context functions pass the caller-supplied buffer size to the decoder without validating it against the actual length of the Python buffer. Data read beyond the buffer may be exposed through nd_get_instrux_bytes, which returns a fixed-length list of 16 bytes. Exploitation requires an application to invoke the affected APIs with a short buffer or an oversized length and to expose the resulting bytes to an attacker. The pybddisasm package is no longer maintained.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_