---
id: "CVE-2026-118446"
kind: "vulnerability"
aliases: ["CVE-2026-118446"]
title: "pybddisasm: use-after-free in INSTRUX array elements can leak process memory"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "pybddisasm", "python"]
not_affected_if: ["no-retained-array-elements", "package-not-used"]
published_at: "2026-11-03T09:17:11+00:00"
first_seen_at: "2026-11-03T09:19:50+00:00"
updated_at: "2026-11-03T09:20:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118446", "first_seen_at": "2026-11-03T09:19:50+00:00"}]
---

# pybddisasm: use-after-free in INSTRUX array elements can leak process memory

The pybddisasm Python bindings expose INSTRUX array members such as ND_OPERAND as Python lists that point into memory owned by the parent object, and do not keep that memory alive. Accessing a retained element after the parent object is freed reads freed memory, which can expose process memory or crash the Python process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project depends on the `pybddisasm` package (for example `pip show pybddisasm`).
- Look for code that keeps references to list elements from INSTRUX objects after the parent object goes out of scope.

## Timeline

- 2026-11-03T09:19:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118446

## From the sources

A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objects, including ND_OPERAND arrays. These arrays are exposed as Python lists whose elements reference memory owned by the parent INSTRUX object. Retaining a list or an element does not keep the parent allocation alive. Accessing an element after the parent INSTRUX object has been freed therefore accesses freed memory. Depending on how the element is used and whether the freed allocation has been reused, this may expose process memory or cause the Python process to crash. Exploitation requires an application to retain and subsequently access an array element after the parent object has been freed. The pybddisasm package is no longer maintained.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_