Live › vulnerability › CVE-2026-118445
The pybddisasm Python bindings return structure-valued members of INSTRUX objects that point into memory owned by the parent object. Keeping a reference to such a member after the parent is freed and then reading it accesses freed memory, which can leak process memory or crash the Python process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 09:19 UTC. All times on this page are UTC.
Only Python code that uses the pybddisasm bindings to disassemble x86 code and keeps member references from INSTRUX objects alive after the parent object is freed. The sources do not say which versions are affected or whether a fixed release exists. Projects that do not use pybddisasm can skip it.
No product ranges from the sources yet.
pybddisasm with pip show pybddisasm or in the lock file.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects. These members are exposed through Python objects that reference memory owned by the parent INSTRUX object. A retained reference to a member does not keep the parent allocation alive. Accessing the member after the parent INSTRUX object has been freed therefore accesses freed memory. Depending on how the member is used and whether the freed allocation has been reused, this may expose process memory or cause the Python process to crash. Exploitation requires an application to retain and subsequently access a member reference after the parent object has been freed. The pybddisasm package is no longer maintained.
This page as .md · .json · in your agent: get_signal("CVE-2026-118445")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.