Live › vulnerability › CVE-2026-118446
The pybddisasm Python bindings expose INSTRUX array members such as ND_OPERAND as Python lists that point into memory owned by the parent object, and do not keep that memory alive. Accessing a retained element after the parent object is freed reads freed memory, which can expose process memory or crash the Python process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 09:19 UTC. All times on this page are UTC.
Only applications that use the pybddisasm Python package and keep references to ND_OPERAND or other array elements of an INSTRUX object after the parent object has been freed. The sources say the package is no longer maintained, so no fixed release is stated. Programs that do not use pybddisasm are not affected.
No product ranges from the sources yet.
pybddisasm package (for example pip show pybddisasm).No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objects, including ND_OPERAND arrays. These arrays are exposed as Python lists whose elements reference memory owned by the parent INSTRUX object. Retaining a list or an element does not keep the parent allocation alive. Accessing an element after the parent INSTRUX object has been freed therefore accesses freed memory. Depending on how the element is used and whether the freed allocation has been reused, this may expose process memory or cause the Python process to crash. Exploitation requires an application to retain and subsequently access an array element after the parent object has been freed. The pybddisasm package is no longer maintained.
This page as .md · .json · in your agent: get_signal("CVE-2026-118446")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.