Live › vulnerability › CVE-2026-118448
The pybddisasm Python bindings return an output buffer from nd_to_text even when text conversion fails, so the buffer may hold uninitialized data. An attacker who can reach an application that passes it failing inputs may read residual process memory or crash the Python process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 09:19 UTC. All times on this page are UTC.
Applications that import pybddisasm and call nd_to_text with parameters that can make conversion fail, then return or use the output. The package is no longer maintained, so no upstream fix is stated in the sources. Teams that do not call nd_to_text, or that never pass it untrusted or invalid input, are unlikely to be exposed.
No product ranges from the sources yet.
pip show pybddisasm to see whether the package is installed and which versionnd_to_text whose results are returned or used when conversion failsNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while still being converted into a Python return value. This may disclose residual process memory or cause the Python process to crash. Exploitation requires an application to invoke nd_to_text in a way that causes conversion to fail and to return or otherwise use the resulting output. The pybddisasm package is no longer maintained.
This page as .md · .json · in your agent: get_signal("CVE-2026-118448")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.