{"id":"CVE-2026-118446","kind":"vulnerability","aliases":["CVE-2026-118446"],"related":[],"title":"pybddisasm: use-after-free in INSTRUX array elements can leak process memory","description":"A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objects, including ND_OPERAND arrays. These arrays are exposed as Python lists whose elements reference memory owned by the parent INSTRUX object. Retaining a list or an element does not keep the parent allocation alive. Accessing an element after the parent INSTRUX object has been freed therefore accesses freed memory. Depending on how the element is used and whether the freed allocation has been reused, this may expose process memory or cause the Python process to crash. Exploitation requires an application to retain and subsequently access an array element after the parent object has been freed. The pybddisasm package is no longer maintained.","summary":"The pybddisasm Python bindings expose INSTRUX array members such as ND_OPERAND as Python lists that point into memory owned by the parent object, and do not keep that memory alive. Accessing a retained element after the parent object is freed reads freed memory, which can expose process memory or crash the Python process.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","pybddisasm","python"],"not_affected_if":["no-retained-array-elements","package-not-used"],"how_to_check":"- Check whether the project depends on the `pybddisasm` package (for example `pip show pybddisasm`).\n- Look for code that keeps references to list elements from INSTRUX objects after the parent object goes out of scope.","fix":null,"status":"open","published_at":"2026-11-03T09:17:11+00:00","first_seen_at":"2026-11-03T09:19:50+00:00","triaged_at":"2026-11-03T09:20:19+00:00","updated_at":"2026-11-03T09:20:19+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T09:20:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"pybddisasm: use-after-free in INSTRUX array elements can leak process memory","impact":"medium","summary":"The pybddisasm Python bindings expose INSTRUX array members such as ND_OPERAND as Python lists that point into memory owned by the parent object, and do not keep that memory alive. Accessing a retained element after the parent object is freed reads freed memory, which can expose process memory or crash the Python process.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","pybddisasm"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"process memory read or Python process crash","analyst_note":"Sources do not state a fixed version or a replacement for the unmaintained pybddisasm package; check the NVD entry and the project repository for guidance.","how_to_check":"- Check whether the project depends on the `pybddisasm` package (for example `pip show pybddisasm`).\n- Look for code that keeps references to list elements from INSTRUX objects after the parent object goes out of scope.","plain_action":"","needs_analyst":true,"not_affected_if":["package-not-used","no-retained-array-elements"],"who_is_affected":"Only applications that use the pybddisasm Python package and keep references to ND_OPERAND or other array elements of an INSTRUX object after the parent object has been freed. The sources say the package is no longer maintained, so no fixed release is stated. Programs that do not use pybddisasm are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000709,"input_tokens":4261,"output_tokens":566,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118446':16A,19A '-2026':15A,18A 'access':54B,130C,142C,180C 'affect':88C 'aliv':53B,129C 'alloc':128C,156C 'applic':175C 'array':8A,29B,90C,99C,101C,182C 'array-valu':89C 'bind':26B,87C 'caus':166C 'crash':73B,171C 'cve':14A,17A 'depend':145C 'element':9A,57B,108C,122C,132C,149C,183C 'exploit':172C 'expos':27B,69B,103C,162C 'free':5A,81C 'freed':63B,65B,140C,143C,155C,190C 'includ':96C 'instrux':7A,28B,94C,115C,136C 'keep':50B,125C 'leak':11A 'list':37B,106C,119C 'longer':196C 'maintain':197C 'may':161C 'member':30B,92C 'memori':13A,41B,52B,66B,71B,110C,144C,164C 'nd':33B,97C 'object':46B,61B,95C,116C,137C,187C 'operand':34B,98C 'own':42B,111C 'packag':20B,193C 'parent':45B,60B,114C,127C,135C,186C 'point':39B 'process':12A,70B,76B,163C,169C 'pybddisasm':1A,21B,24B,85C,192C 'python':22B,25B,36B,75B,86C,105C,168C 'read':64B 'refer':109C 'requir':173C 'retain':56B,117C,177C 'reus':159C 'subsequ':179C 'therefor':141C 'use':3A,79C,151C 'use-after-fre':2A,78C 'valu':91C 'vulner':82C 'whether':153C 'whose':107C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use the pybddisasm Python package and keep references to ND_OPERAND or other array elements of an INSTRUX object after the parent object has been freed. The sources say the package is no longer maintained, so no fixed release is stated. Programs that do not use pybddisasm are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","pybddisasm","python"],"first_public_at":"2026-11-03T09:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-requests@bitdefender.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118446","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118446","severity":null,"published_at":"2026-11-03T09:17:11+00:00","modified_at":"2026-11-03T09:17:11+00:00","first_seen_at":"2026-11-03T09:19:50+00:00","fetched_at":"2026-11-03T09:19:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}